WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
pagelayer
Published
2026-03-12
Title
PageLayer < 2.0.9 - Authenticated (Contributor+) Information Exposure
Slug
pagelayer
Published
2026-06-12
Title
Page Builder: Pagelayer – Drag and Drop website builder < 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block
Slug
pagelayer
Published
2026-06-12
Title
Pagelayer < 2.1.0 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'
Slug
pagemanager
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
pagemash
Published
2024-03-29
Title
pageMash > Page Management <= 1.3.0 - Reflected Cross-Site Scripting
Slug
pagepost-content-shortcode
Published
2021-11-15
Title
Page/Post Content Shortcode <= 1.0 - Contributor+ Arbitrary Posts/Pages Access
Slug
pagepost-specific-social-share-buttons
Published
2025-02-13
Title
Page/Post Specific Social Share Buttons <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
pagerank-tools
Published
2024-06-07
Title
Pagerank Tools <= 1.1.5 - Reflected XSS
Slug
pagerank-tools
Published
2025-11-03
Title
Pagerank Tools <= 1.1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
pagerestrict
Published
2015-08-25
Title
Page Restrict <= 2.2.1 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
pagerestrict
Published
2024-01-31
Title
Page Restrict <= 2.5.5 - Cross-Site Request Forgery via pr_admin_page
Slug
pagerestrict
Published
2024-02-27
Title
Page Restrict <= 2.5.5 - Unauthenticated Protected Post Access
Slug
pages-order
Published
2025-04-01
Title
Pages Order <= 1.1.3 - Reflected Cross-Site Scripting
Slug
pagination
Published
2017-04-12
Title
Multiple BestWebSoft Plugins - Authenticated Cross-Site Scripting (XSS)
Slug
pagination
Published
2023-03-27
Title
Pagination by BestWebSoft < 1.2.3 - Admin+ Stored XSS
Slug
pago-redsys-tpv-grafreak
Published
2025-02-21
Title
Pago por Redsys < 1.0.13 - Reflected Cross-Site Scripting
Slug
pagopar-woocommerce-gateway
Published
2025-04-09
Title
Pagopar – WooCommerce Gateway < 2.8.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
paid-business-listings
Published
2014-08-01
Title
Paid Business Listings - Blind SQL Injection
Slug
paid-downloads
Published
2014-08-01
Title
Paid Downloads < 2.21 - SQL Injection
Slug
paid-downloads
Published
2026-01-21
Title
Paid Downloads <= 3.15 - Unauthenticated SQL Injection
Slug
paid-member-subscriptions
Published
2021-07-26
Title
Paid Member Subscriptions < 2.4.2 - Reflected Cross-Site Scripting (XSS)
Slug
paid-member-subscriptions
Published
2021-08-06
Title
Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection
Slug
paid-member-subscriptions
Published
2023-12-27
Title
Paid Member Subscriptions < 2.10.5 - Cross-Site Request Forgery via ajax_add_log_entry
Slug
paid-member-subscriptions
Published
2024-02-13
Title
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction < 2.11.2 - Missing Authorization via creating_pricing_table_page
Slug
paid-member-subscriptions
Published
2024-02-13
Title
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction < 2.11.2 - Missing Authorization via pms_stripe_connect_handle_authorization_return