WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
postgallery
Published
2025-12-04
Title
PostGallery <= 1.12.5 - Authenticated (Subscriber+) Arbitrary File Upload
Slug
posti-shipping
Published
2024-12-03
Title
Posti Shipping < 3.10.4 - Reflected Cross-Site Scripting
Slug
posti-shipping
Published
2024-11-28
Title
Posti Shipping < 3.10.3 - Full Path Disclosure
Slug
posti-shipping
Published
2024-12-14
Title
Posti Shipping < 3.10.4 - Cross-Site Request Forgery
Slug
postie
Published
2012-08-08
Title
Postie 1.4.3 - Stored Cross-Site Scripting (XSS)
Slug
postie
Published
2020-01-02
Title
Postie < 1.9.41 - Post Submission Spoofing & Stored Cross-Site Scripting (XSS)
Slug
postie
Published
2025-09-08
Title
Postie < 1.9.71 - Admin+ Stored XSS
Slug
postie
Published
2025-12-31
Title
Postie < 1.9.74 - Contributor+ Stored XSS
Slug
postify-for-elementor
Published
2024-11-08
Title
Postify: Post Layout For Elementor <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
postlists
Published
2024-12-19
Title
PostLists <= 2.0.2 - Reflected XSS
Slug
postmagthemes-demo-import
Published
2022-11-11
Title
PostmagThemes Demo < 1.0.8 - Admin+ Arbitrary File Upload
Slug
postman-smtp
Published
2017-06-29
Title
Postman SMTP Mailer/Email Log - Cross-Site Scripting (XSS)
Slug
postman-widget
Published
2024-12-02
Title
Paloma Widget <= 1.14 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
postmarkapp-email-integrator
Published
2025-03-31
Title
PostmarkApp Email Integrator <= 2.4 - Missing Authorization
Slug
postmarkapp-email-integrator
Published
2025-03-31
Title
PostmarkApp Email Integrator <= 2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
postmarkapp-email-integrator
Published
2026-02-18
Title
PostmarkApp Email Integrator <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
Slug
postmash
Published
2024-02-15
Title
postMash – custom post order <= 1.2.0 - Unauthenticated SQL Injection
Slug
postmash
Published
2024-02-26
Title
postMash – custom post order <= 1.2.0 - Reflected Cross-Site Scripting via m
Slug
postmash-custom
Published
2025-03-26
Title
postMash Custom – custom post order <= 1.0.3 - Unauthenticated SQL Injection
Slug
postmatic
Published
2015-09-13
Title
Postmatic <= 1.4.5 - Cross-Site Scripting (XSS)
Slug
postmatic
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
postmatic
Published
2023-02-08
Title
Replyable < 2.2.10 - Subscriber+ PHP Object Injection
Slug
postmatic
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
postpage-import-export-with-custom-fields-taxonomies
Published
2025-01-03
Title
Post/Page Copying Tool < 2.0.1 - Unauthenticated Sensitive Information Exposure
Slug
postpage-import-export-with-custom-fields-taxonomies
Published
2025-01-20
Title
Post/Page Copying Tool to Export and Import post/page for Cross site Migration < 2.0.4 - Authenticated (Contributor+) Arbitrary File Upload