WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
penci-shortcodes
Published
2026-01-10
Title
Penci Shortcodes & Performance < 6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
pending-order-bot
Published
2025-08-17
Title
Pending Order Bot <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
people-lists
Published
2025-01-24
Title
People Lists < 2.0.0 - Missing Authorization
Slug
peoplepond
Published
2024-07-11
Title
PeoplePond <= 1.1.9 - CSRF to Stored XSS
Slug
pepro-bacs-receipt-upload-for-woocommerce
Published
2024-11-15
Title
PeproDev WooCommerce Receipt Uploader < 2.7.0 - Reflected Cross-Site Scripting
Slug
pepro-bacs-receipt-upload-for-woocommerce
Published
2026-07-29
Title
PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR
Slug
pepro-bacs-receipt-upload-for-woocommerce
Published
2026-07-29
Title
PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR
Slug
pepro-cf7-database
Published
2023-09-25
Title
PeproDev CF7 Database < 1.8.0 - Unauthenticated Stored XSS
Slug
pepro-cf7-database
Published
2024-04-16
Title
PeproDev CF7 Database < 1.9.0 - Cross-Site Request Forgery
Slug
pepro-cf7-database
Published
2025-04-02
Title
PeproDev CF7 Database <= 2.0.0 - Unauthenticated Stored Cross-Site Scripting
Slug
pepro-ultimate-invoice
Published
2024-02-20
Title
PeproDev Ultimate Invoice < 1.9.8 - Unauthenticated Arbitrary Invoice Access
Slug
pepro-ultimate-invoice
Published
2024-04-15
Title
PeproDev Ultimate Invoice < 2.0.2 - Missing Authorisation
Slug
pepro-ultimate-invoice
Published
2024-10-15
Title
PeproDev Ultimate Invoice < 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
pepro-ultimate-invoice
Published
2025-02-18
Title
PeproDev Ultimate Invoice < 2.1.0 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure
Slug
pepro-ultimate-invoice
Published
2026-03-04
Title
PeproDev Ultimate Invoice < 2.2.6 - Unauthenticated Invoice Archive Download
Slug
pepro-ultimate-invoice
Published
2026-07-23
Title
PeproDev Ultimate Invoice <= 2.2.6 - Missing Authorization
Slug
pepro-ultimate-invoice
Published
2026-07-23
Title
PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Stored Cross-Site Scripting
Slug
pepro-ultimate-invoice
Published
2026-07-23
Title
PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Information Exposure
Slug
pepro-ultimate-invoice
Published
2026-07-23
Title
PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Server-Side Request Forgery
Slug
peprodev-ups
Published
2025-05-06
Title
PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Limited Unauthenticated Arbitrary User Meta Update
Slug
peprodev-ups
Published
2025-05-06
Title
PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Authentication Bypass to Account Takeover
Slug
peprodev-ups
Published
2025-05-06
Title
PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Unauthenticated Email Enumeration
Slug
per-page-add-to
Published
2021-08-11
Title
Per Page Add to Head <= 1.4.4 - Authenticated Stored XSS
Slug
per-page-add-to
Published
2021-08-11
Title
Per Page Add to Head < 1.4.4 - CSRF to Stored XSS
Slug
percent-to-infograph
Published
2026-02-13
Title
Percent to Infograph <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes