WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
popup-with-fancybox
Published
2023-10-30
Title
Popup with fancybox < 3.6 - Authenticated (Subscriber+) SQL Injection via Shortcode
Slug
popup-zyrex
Published
2023-04-04
Title
Zyrex Popup < 1.1 - Admin+ Arbitrary File Upload
Slug
popup4phone
Published
2024-04-26
Title
Popup4Phone <= 1.3.2 - Editor+ Stored XSS
Slug
popup4phone
Published
2024-04-26
Title
Popup4Phone <= 1.3.2 - Unauthenticated Stored XSS
Slug
popupally
Published
2024-01-30
Title
PopupAlly < 2.1.1 - Cross-Site Request Forgery via optin_submit_callback
Slug
popupally
Published
2024-04-25
Title
PopupAlly < 2.1.2 - Admin+ Stored XSS
Slug
popupally
Published
2024-05-20
Title
PopupAlly < 2.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
popups
Published
2022-07-05
Title
WordPress Popup <= 1.9.3.8 - Admin+ Stored Cross-Site Scripting
Slug
popups
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
porn-videos-embed
Published
2025-08-06
Title
Porn Videos Embed <= 0.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
porsline
Published
2024-10-31
Title
Porsline < 1.1 - Contributor+ SQL Injection
Slug
portable-phpmyadmin
Published
2014-08-01
Title
portable-phpMyAdmin < 1.3.1 - Authentication Bypass
Slug
portable-phpmyadmin
Published
2014-08-01
Title
Portable phpMyAdmin - /pma/phpinfo.php Direct Request System Information Disclosure
Slug
portable-phpmyadmin
Published
2014-08-01
Title
Portable phpMyAdmin 1.4.1 - Multiple Script Direct Request Authentication Bypass
Slug
portfolio
Published
2017-04-12
Title
Multiple BestWebSoft Plugins - Authenticated Cross-Site Scripting (XSS)
Slug
portfolio
Published
2025-09-22
Title
Portfolio <= 2.58 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
portfolio-and-projects
Published
2025-03-14
Title
Portfolio and Projects <= 1.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
portfolio-and-projects
Published
2025-12-05
Title
Portfolio and Projects < 1.5.6 - Authenticated (Contributor+) Information Exposure
Slug
portfolio-and-projects
Published
2026-04-13
Title
Multiple Plugins by "Essential Plugin" - Backdoor
Slug
portfolio-builder-elementor
Published
2024-11-19
Title
Elementor Portfolio Builder <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
portfolio-by-lisa-westlund
Published
2015-07-20
Title
Portfolio 1.0 - Cross-Site Request Forgery (CSRF)
Slug
portfolio-elementor
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
portfolio-elementor
Published
2023-01-03
Title
Portfolio for Elementor, Image Gallery & Post Grid | PowerFolio < 2.3.1 - Contributor+ Stored XSS via Shortcode
Slug
portfolio-elementor
Published
2024-01-16
Title
Post Grid, Image Gallery & Portfolio for Elementor | PowerFolio < 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Slug
portfolio-elementor
Published
2025-07-03
Title
Portfolio for Elementor & Image Gallery | PowerFolio < 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS