WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
post-meta-data-manager
Published
2025-03-07
Title
Post Meta Data Manager <= 1.4.4 - Authentciated (Admin+) Multisite Privilege Escalation
Slug
post-page-notes
Published
2025-01-16
Title
Post & Page Notes <= 0.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
post-pay-counter
Published
2017-09-16
Title
Post Pay Counter < 2.731 - PHP Obj Injection & Access Control Issues
Slug
post-pay-counter
Published
2023-11-08
Title
Post Pay Counter < 2.790 - Reflected XSS
Slug
post-pdf-export
Published
2020-03-24
Title
Multiple plugins - Unauthenticated Dompdf Local File Inclusion (LFI)
Slug
post-plugin-library
Published
2024-03-29
Title
Post-Plugin Library <= 2.6.2.1 - Reflected Cross-Site Scripting
Slug
post-rating-and-review
Published
2025-06-25
Title
Post Rating and Review <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter
Slug
post-read-time
Published
2025-03-11
Title
Post Read Time <= 1.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
post-saint
Published
2025-01-06
Title
Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
Slug
post-shortcode
Published
2023-04-17
Title
Post Shortcode <= 2.0.9 - Contributor+ Stored Cross-Site Scripting
Slug
post-slider-and-carousel
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
post-slider-and-carousel
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
post-slider-and-carousel
Published
2025-05-13
Title
Post Slider and Carousel with Widget < 3.2.10 - Admin+ Stored XSS
Slug
post-slider-carousel
Published
2023-11-03
Title
Post Sliders & Post Grids < 1.0.21 - Admin+ Stored XSS
Slug
post-slides
Published
2026-01-16
Title
Post Slides <= 1.0.1 - Contributor+ Local File Inclusion
Slug
post-smtp
Published
2021-02-12
Title
Post SMTP Mailer/Email Log < 2.0.21 - CSRF Nonce Bypass
Slug
post-smtp
Published
2022-08-22
Title
Post SMTP < 2.1.4 - Admin+ Stored Cross-Site Scripting
Slug
post-smtp
Published
2022-09-05
Title
Post SMTP < 2.1.7 - Admin+ Blind SSRF
Slug
post-smtp
Published
2023-07-11
Title
Post SMTP < 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Email Contents
Slug
post-smtp
Published
2023-06-26
Title
POST SMTP Mailer < 2.5.7 - Arbitrary Log Deletion via CSRF
Slug
post-smtp
Published
2023-06-26
Title
POST SMTP Mailer < 2.5.7 - Account Takeover via CSRF
Slug
post-smtp
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
post-smtp
Published
2023-11-06
Title
POST SMTP Mailer < 2.7.1 - Unauthenticated Cross-site Scripting
Slug
post-smtp
Published
2023-12-21
Title
Post SMTP < 2.8.7 - Reflected Cross-Site Scripting
Slug
post-smtp
Published
2023-10-03
Title
Post SMTP < 2.6.1 - Authenticated (Administrator+) SQL Injection