WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
post-index
Published
2021-07-28
Title
Post Index <= 0.7.5 - CSRF to Stored XSS
Slug
post-indexer
Published
2016-11-17
Title
Post Indexer <= 3.0.6.1 - PHP Object Injection via MitM
Slug
post-indexer
Published
2016-11-17
Title
Post Indexer <= 3.0.6.1 - Authenticated SQL Injection
Slug
post-layouts
Published
2024-07-10
Title
Post Layouts for Gutenberg < 1.2.11 - Contributor+ Stored XSS
Slug
post-like-dislike
Published
2026-01-06
Title
Post Like Dislike <= 1.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Slug
post-list-designer
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
post-list-designer
Published
2023-01-06
Title
Posts List Designer by Category < 3.2 - Contributor+ Stored XSS via Shortcode
Slug
post-list-designer
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
post-list-designer
Published
2024-01-19
Title
Posts List Designer by Category < 3.3.3 - Contributor+ Stored Cross-Site Scripting
Slug
post-list-designer
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Slug
post-list-featured-image
Published
2025-10-09
Title
Post List Featured Image <= 0.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
post-list-with-featured-image
Published
2023-07-19
Title
Post List With Featured Image <= 1.2.1 - Reflected XSS
Slug
post-lockdown
Published
2025-03-07
Title
Post Lockdown < 4.0.3 - Missing Authorization to Authenticated (Subscriber+) Post Disclosure
Slug
post-meta
Published
2025-01-16
Title
Post Meta < 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
post-meta-data-manager
Published
2023-10-27
Title
Post Meta Data Manager < 1.2.1 - Unauthenticated Data Deletion
Slug
post-meta-data-manager
Published
2023-10-27
Title
Post Meta Data Manager < 1.2.1 - Subscriber+ Privilege Escalation
Slug
post-meta-data-manager
Published
2023-11-20
Title
Post Meta Data Manager < 1.2.2 - Cross-Site Request Forgery to Post, Term, and User Meta Deletion
Slug
post-meta-data-manager
Published
2023-10-20
Title
Post Meta Data Manager < 1.2.1 - Missing Authorization to Post, Term, and User Meta Deletion
Slug
post-meta-data-manager
Published
2024-07-01
Title
Post Meta Data Manager < 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
post-meta-data-manager
Published
2025-03-07
Title
Post Meta Data Manager <= 1.4.4 - Authentciated (Admin+) Multisite Privilege Escalation
Slug
post-my-contact-form-7
Published
2026-07-23
Title
Post My CF7 Form < 7.0.0 - Missing Authorization
Slug
post-page-notes
Published
2025-01-16
Title
Post & Page Notes <= 0.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
post-pay-counter
Published
2017-09-16
Title
Post Pay Counter < 2.731 - PHP Obj Injection & Access Control Issues
Slug
post-pay-counter
Published
2023-11-08
Title
Post Pay Counter < 2.790 - Reflected XSS
Slug
post-pdf-export
Published
2020-03-24
Title
Multiple plugins - Unauthenticated Dompdf Local File Inclusion (LFI)