WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
post-duplicator
Published
2023-12-05
Title
Post Duplicator < 2.32 - Missing Authorization via mtphr_duplicate_post
Slug
post-duplicator
Published
2025-01-10
Title
Post Duplicator < 2.37 - Authenticated (Contributor+) Protected Post Disclosure
Slug
post-duplicator
Published
2025-01-24
Title
Post Duplicator < 2.36 - Missing Authorization
Slug
post-duplicator
Published
2026-02-24
Title
Post Duplicator < 3.0.9 - Missing Authorization to Authenticated (Contributor+) Protected Post Meta Insertion via 'customMetaData' Parameter
Slug
post-expirator
Published
2014-08-01
Title
Post Expirator <= 2.1.1 - Cross-Site Request Forgery
Slug
post-expirator
Published
2021-10-11
Title
Post Expirator < 2.6.0 - Contributor+ Arbitrary Post Schedule Deletion
Slug
post-expirator
Published
2025-11-20
Title
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories < 4.9.2 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification
Slug
post-expirator
Published
2025-12-15
Title
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories < 4.9.3 - Missing Authorization to Authenticated (Contributor+) Authors' Emails Exposure
Slug
post-expirator
Published
2026-01-08
Title
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories < 4.9.4 - Missing Authorization to Authenticated (Contributor+) Workflow Manipulation
Slug
post-expirator
Published
2026-01-11
Title
Post Expirator < 4.9.4 - Missing Authorization
Slug
post-featured-video
Published
2025-09-26
Title
Post Featured Video <= 1.7 - Cross-Site Request Forgery
Slug
post-flagger
Published
2026-03-20
Title
Post Flagger <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slug' Shortcode Attribute
Slug
post-from-frontend
Published
2024-10-15
Title
Post From Frontend <= 1.0.0 - Post Deletion via CSRF
Slug
post-gallery
Published
2014-08-01
Title
Post Gallery - Cross-Site Scripting (XSS)
Slug
post-grid
Published
2016-11-08
Title
Post Grid <= 2.0.12 - Unauthenticated Arbitrary File Deletion
Slug
post-grid
Published
2020-10-05
Title
Post Grid < 2.0.73 & Team Showcase < 1.22.16 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
post-grid
Published
2020-10-05
Title
Post Grid < 2.0.73 & Team Showcase < 1.22.16 - PHP Object Injection
Slug
post-grid
Published
2021-06-28
Title
Post Grid < 2.1.8 - Reflected Cross-Site Scripting (XSS)
Slug
post-grid
Published
2021-12-15
Title
Post Grid < 2.1.13 - Contributor+ SQL Injection
Slug
post-grid
Published
2022-03-15
Title
Post Grid < 2.1.16 - Reflected Cross-Site Scripting via keyword
Slug
post-grid
Published
2022-03-15
Title
Post Grid < 2.1.16 - Reflected Cross-Site Scripting via post_types
Slug
post-grid
Published
2023-12-15
Title
Post Grid Combo – 36+ Gutenberg Blocks < 2.2.65 - Authenticated (Contributor+) Cross-Site Scripting
Slug
post-grid
Published
2024-03-12
Title
Post Grid Combo – 36+ Gutenberg Blocks < 2.2.69 - Information Exposure via get_posts API Endpoint
Slug
post-grid
Published
2024-03-19
Title
Combo Blocks < 2.2.76 - Unauthenticated Password Protected Posts Access
Slug
post-grid
Published
2024-03-28
Title
Post Grid < 2.2.76 - Reflected Cross-Site Scripting