WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
ppv-live-webcams
Published
2025-10-16
Title
Paid Videochat Turnkey Site <= 7.3.23 - Admin+ Remote Code Execution
Slug
ppv-live-webcams
Published
2026-03-06
Title
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams < 7.3.21 - Authenticated (Author+) Privilege Escalation
Slug
prague-plugins
Published
2026-01-27
Title
Prague < 2.2.9 - Unauthenticated Stored Cross-Site Scripting
Slug
pramadillo-activecampaign-email-preference-center
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
pramadillo-activecampaign-email-preference-center
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
pray-for-me
Published
2024-05-24
Title
Pray For Me <= 1.0.4 - Settings Update via CSRF
Slug
pray-for-me
Published
2024-05-24
Title
Pray For Me <= 1.0.4 - Unauthenticated Stored XSS
Slug
prayer-times-anywhere
Published
2025-01-07
Title
Prayer Times Anywhere <= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
prdctfltr
Published
2021-09-20
Title
Multiple WooCommerce Add-Ons - Low Priv Arbitrary Blog Options Update/Access/Deletion & Plugin's Settings Update/Export/Import
Slug
prdctfltr
Published
2026-02-05
Title
Product Filter for WooCommerce <= 9.1.2 - Shop Manager+ Privilege Escalation
Slug
pre-orders-for-woocommerce
Published
2023-10-26
Title
Pre-Orders for WooCommerce < 1.2.14 - Contributor+ Stored XSS
Slug
pre-party-browser-hints
Published
2023-12-21
Title
Pre* Party Resource Hints < 1.8.20 - Admin+ SQLi
Slug
pre-party-browser-hints
Published
2026-03-20
Title
Pre* Party Resource Hints <= 1.8.20 - Authenticated (Subscriber+) SQL Injection via 'hint_ids' Parameter
Slug
pre-publish-checklist
Published
2023-09-22
Title
Pre-Publish Checklist < 1.1.2 - Insecure Direct Object Reference to Arbitrary Post '_ppc_meta_key' Update
Slug
pre-publish-post-checklist
Published
2025-06-27
Title
Pre-Publish Post Checklist <= 3.1 - Missing Authorization
Slug
precious-metals-chart-and-widgets
Published
2025-01-23
Title
Precious Metals Charts and Widgets for WordPress < 1.2.9 - Authenticated (Contributor+) Stored Cross-site Scripting
Slug
precise-columns
Published
2025-11-10
Title
Precise Columns <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
predict-when
Published
2025-01-16
Title
Predict When <= 1.3 - Reflected Cross-Site Scripting
Slug
preferred-languages
Published
2024-05-30
Title
Preferred Languages < 2.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
preload-current-images
Published
2025-11-10
Title
Preload Current Images <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
preloader-for-divi
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
preloader-for-divi
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
preloader-for-website
Published
2023-11-21
Title
Preloader for Website < 1.3 - Missing Authorization via plwao_register_settings()
Slug
preloader-plus
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
preloader-plus
Published
2024-09-06
Title
Preloader Plus – WordPress Loading Screen Plugin <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload