WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
photographer-directory
Published
2023-03-06
Title
Multiple e-plugins - Subscriber+ Privilege Escalation
Slug
photographers-galleries
Published
2025-10-21
Title
Photographers galleries <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
photography-portfolio
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
photokit
Published
2024-10-17
Title
photokit <= 1.0 - Unauthenticated Arbitrary File Upload
Slug
photonic
Published
2025-11-17
Title
Photonic Gallery & Lightbox for Flickr, SmugMug & Others < 3.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via Caption Attribute
Slug
photoracer
Published
2014-08-01
Title
Photoracer 1.0 - (id) SQL Injection
Slug
photoracer
Published
2014-08-01
Title
Photoracer <= 1.0 - SQL Injection
Slug
photoracer
Published
2014-08-01
Title
Photoracer <= 1.0 - Multiple Vulnerabilities
Slug
photoshelter-official-plugin
Published
2025-04-01
Title
PhotoShelter for Photographers Blog Feed Plugin <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
photoshow
Published
2024-06-22
Title
Smart Image Gallery < 1.0.19 - Update/Delete Google API Key via CSRF
Slug
photospace
Published
2022-09-12
Title
Photospace Gallery <= 2.3.5 - Subscriber+ Arbitrary Settings Update
Slug
photospace
Published
2022-11-14
Title
Photospace Gallery <= 2.3.5 - Subscriber+ Stored Cross-Site Scripting
Slug
photospace-responsive
Published
2019-06-22
Title
Photospace Responsive < 1.1.8 - Authenticated XSS
Slug
photospace-responsive
Published
2023-09-12
Title
Photospace Responsive < 2.1.2 - Admin+ Stored XSS
Slug
photospace-responsive
Published
2025-09-27
Title
Photospace Responsive <= 2.2.0 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
photostack-gallery
Published
2026-02-13
Title
PhotoStack Gallery <= 0.4.1 - Unauthenticated SQL Injection via 'postid' Parameter
Slug
photoswipe-masonry
Published
2022-02-24
Title
Photoswipe Masonry Gallery < 1.2.15 - Subscriber+ Stored Cross-Site Scripting
Slug
photoxhibit
Published
2016-10-10
Title
Photoxhibit <= 2.1.8 - Reflected XSS Issues
Slug
phox-host
Published
2026-03-18
Title
Phox Hosting < 2.0.9 - Reflected Cross-Site Scripting
Slug
php-analytics
Published
2014-08-01
Title
php-analytics - ofc_upload_image.php Arbitrary File Upload
Slug
php-compatibility-checker
Published
2023-04-06
Title
PHP Compatibility Checker < 1.6.0 - Cross-Site Request Forgery
Slug
php-event-calendar
Published
2015-04-02
Title
PHP Event Calendar <= 1.5 - Arbitrary File Upload
Slug
php-everywhere
Published
2022-01-13
Title
PHP Everywhere < 2.0.3 - Arbitrary Settings Update via CSRF
Slug
php-everywhere
Published
2022-02-08
Title
PHP Everywhere < 3.0.0 - Subscriber+ RCE via Shortcode
Slug
php-everywhere
Published
2022-02-08
Title
PHP Everywhere < 3.0.0 - Contributor+ RCE via Metabox