WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
pods
Published
2026-06-15
Title
Pods – Custom Content Types and Fields < 3.3.9 - Unauthenticated Stored Cross-Site Scripting
Slug
pods
Published
2026-08-15
Title
Pods < 3.3.9.1 - Unauthenticated Privilege Escalation via 'pods_admin' AJAX Router
Slug
pods
Published
2026-08-15
Title
Pods < 3.3.9.1 - Unauthenticated Privilege Escalation via 'pods_admin' AJAX Router
Slug
pods
Published
2026-08-15
Title
Pods < 3.3.9.1 - Unauthenticated Privilege Escalation via 'pods_admin' AJAX Router
Slug
pods
Published
2026-08-15
Title
Pods < 3.3.9.1 - Unauthenticated Privilege Escalation via 'pods_admin' AJAX Router
Slug
pods
Published
2026-08-15
Title
Pods < 3.3.9.1 - Unauthenticated Privilege Escalation via 'pods_admin' AJAX Router
Slug
pods
Published
2026-08-15
Title
Pods < 3.3.9.1 - Unauthenticated Privilege Escalation via 'pods_admin' AJAX Router
Slug
pods
Published
2026-09-04
Title
Pods < 3.3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute
Slug
pods
Published
2026-08-24
Title
Pods < 3.3.9.1 - Author+ RCE via Shortcode Display Callback
Slug
pods
Published
2026-09-02
Title
Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback
Slug
poeditor
Published
2023-08-07
Title
POEditor < 0.9.8 - Settings Reset via CSRF
Slug
poeditor
Published
2023-10-03
Title
POEditor < 0.9.5 - CSRF
Slug
poeditor
Published
2024-04-12
Title
POEditor < 0.9.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
poeditor
Published
2025-06-05
Title
POEditor < 0.9.11 - Cross-Site Request Forgery
Slug
point-maker
Published
2024-10-15
Title
Point Maker < 0.1.5 - Authenticated (Contributor+) Local File Inclusion
Slug
point-maker
Published
2025-03-04
Title
Point Maker <= 0.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
points-and-rewards-for-woocommerce
Published
2026-01-19
Title
Points and Rewards for WooCommerce < 2.9.6 - Missing Authorization
Slug
points-and-rewards-for-woocommerce
Published
2026-07-10
Title
Points and Rewards for WooCommerce < 2.10.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions
Slug
points-and-rewards-for-woocommerce
Published
2026-07-13
Title
Points and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation via IDOR
Slug
pojo-accessibility
Published
2025-04-09
Title
One Click Accessibility < 3.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
pojo-accessibility
Published
2025-10-15
Title
Ally - Web Accessibility & Usability < 3.8.1 - Cross-Site Request Forgery to Plugin Settings Update
Slug
pojo-accessibility
Published
2026-02-19
Title
Ally < 4.0.3 - Missing Authorization
Slug
pojo-accessibility
Published
2026-03-10
Title
Ally < 4.1.0 - Unauthenticated SQLi via URL Path
Slug
pojo-forms
Published
2024-12-05
Title
Pojo Forms < 1.4.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via form_preview_shortcode
Slug
policy-genius
Published
2025-01-10
Title
Policy Genius <= 2.0.4 - Reflected XSS