WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
pmpro-add-member-admin
Published
2026-06-26
Title
Paid Memberships Pro - Add Member From Admin < 0.7.3 - Cross-Site Request Forgery
Slug
pmpro-mailchimp
Published
2024-03-28
Title
Paid Memberships Pro – Mailchimp Add On < 2.3.5 - Unauthenticated Information Disclosure
Slug
pmpro-member-directory
Published
2024-07-09
Title
Paid Memberships Pro - Member Directory Add On < 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLi
Slug
pmpro-membership-maps
Published
2024-07-09
Title
Paid Memberships Pro - Membership Maps Add On < 0.7 - Contributor+ Sensitive Information Disclosure
Slug
pmpro-payfast
Published
2024-03-28
Title
Paid Memberships Pro – Payfast Gateway Add On < 1.4.2 - Unauthenticated Information Exposure
Slug
pmpro-register-helper
Published
2023-01-06
Title
Custom User Profile Fields for User Registration & Member Frontend Profiles with Paid Memberships Pro < 1.8.1 - Contributor+ Stored XSS via Shortcode
Slug
png-to-jpg
Published
2022-05-06
Title
PNG to JPG < 4.1 - Stored Cross-Site Scripting via CSRF
Slug
pochipp
Published
2025-12-14
Title
Pochipp < 1.18.1 - Missing Authorization
Slug
pochipp
Published
2026-02-25
Title
Pochipp < 1.18.9 - Missing Authorization
Slug
pochipp
Published
2026-09-18
Title
Pochipp < 1.20.3 - Reflected Cross-Site Scripting via 'keyword' Parameter
Slug
pocket-news-generator
Published
2024-03-28
Title
Pocket News Generator <= 0.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting
Slug
pocket-news-generator
Published
2024-03-28
Title
Pocket News Generator <= 0.2.0 - Cross-Site Request Forgery to Settings Update
Slug
pocket-widget
Published
2024-08-19
Title
Pocket Widget <= 0.1.3 - Admin+ Stored XSS
Slug
podamibe-custom-user-gravatar
Published
2026-10-13
Title
Podamibe Custom User Gravatar <= 1.0.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
podamibe-twilio-private-call
Published
2025-01-16
Title
Podamibe Twilio Private Call <= 1.0.1 - Reflected Cross-Site Scripting
Slug
podcast-box
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
podcast-box
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
podcast-channels
Published
2014-04-25
Title
Podcast Channels < 0.28 - Unauthenticated Reflected XSS
Slug
podcast-feed-player-widget
Published
2025-06-27
Title
Podcast Feed Player Widget and Shortcode <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
podcast-importer-secondline
Published
2021-04-13
Title
Podcast Importer SecondLine < 1.1.5 - Server-Side Request Forgery (SSRF)
Slug
podcast-importer-secondline
Published
2022-03-21
Title
Podcast Importer SecondLine < 1.3.8 - Admin+ SQLi
Slug
podcast-importer-secondline
Published
2026-09-23
Title
Podcast Importer SecondLine < 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
podcast-player
Published
2026-08-06
Title
Podcast Player < 8.3.1 - Unauthenticated Server-Side Request Forgery
Slug
podcast-subscribe-buttons
Published
2021-09-15
Title
Podcast Subscribe Buttons < 1.4.2 - Contributor+ Stored XSS
Slug
podcast-subscribe-buttons
Published
2023-10-03
Title
Podcast Subscribe Buttons < 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode