WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
pressprimer-quiz
Published
2026-06-17
Title
PressPrimer Quiz < 2.3.1 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Modification via 'quiz_id', 'item_id', and 'rule_id' Parameters
Slug
presto-player
Published
2024-03-20
Title
The Ultimate Video Player For WordPress < 2.2.3 - Contributor+ Stored XSS
Slug
presto-player
Published
2024-08-16
Title
Presto Player < 3.0.3 - Missing Authorization
Slug
presto-player
Published
2026-05-19
Title
The Ultimate Video Player For WordPress – by Presto Player < 4.1.4 - Missing Authorization
Slug
presto-player
Published
2026-06-11
Title
The Ultimate Video Player For WordPress < 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link_url' Shortcode Attribute
Slug
presto-player
Published
2026-10-05
Title
Presto Player < 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
presto-player
Published
2026-10-09
Title
Presto Player < 4.5.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content
Slug
presto-player
Published
2026-10-15
Title
Presto Player < 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
presto-player-pro
Published
2026-10-08
Title
Presto Player Pro < 3.0.2 - Authenticated (Author+) Arbitrary File Deletion
Slug
pretix-widget
Published
2024-10-09
Title
pretix widget < 1.0.6 - Authenticated (Contributor+) Local File Inclusion
Slug
pretty-file-links
Published
2025-03-24
Title
Pretty file links <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
pretty-google-calendar
Published
2023-09-25
Title
Pretty Google Calendar < 1.6.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via pretty_google_calendar shortcode
Slug
pretty-google-calendar
Published
2024-04-25
Title
Pretty Google Calendar < 2.0.0 - Contributor+ Stored XSS
Slug
pretty-google-calendar
Published
2025-12-19
Title
Pretty Google Calendar < 2.0.1 - Missing Authorization to Unauthenticated Google API Key Exposure
Slug
pretty-grid
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
pretty-link
Published
2012-05-15
Title
Pretty Link Lite <= 1.5.3 - Cross-Site Scripting (XSS)
Slug
pretty-link
Published
2014-08-01
Title
Pretty Link Lite <= 1.6.0 - Cross-Site Scripting (XSS)
Slug
pretty-link
Published
2014-08-01
Title
Pretty Link Lite <= 1.6.2 - XSS in SWF
Slug
pretty-link
Published
2015-07-08
Title
Pretty Link Lite <= 1.6.7 - Authenticated SQL Injection
Slug
pretty-link
Published
2019-06-19
Title
Shortlinks by Pretty Links <= 2.1.9 - Stored XSS and CSV Injection
Slug
pretty-link
Published
2023-04-13
Title
Shortlinks by Pretty Links < 3.4.1 - Link Visit Stats Clear via CSRF
Slug
pretty-link
Published
2024-03-22
Title
Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing < 3.6.4 - Plugin Settings Update via CSRF
Slug
pretty-link
Published
2024-03-25
Title
Shortlinks by Pretty Links < 3.6.3 - Reflected Cross-Site Scripting via post_status
Slug
pretty-link
Published
2025-05-19
Title
Shortlinks by Pretty Links < 3.6.16 - Missing Authorization
Slug
pretty-link
Published
2026-08-04
Title
PrettyLinks < 3.6.21 - Authenticated (Administrator+) SQL Injection via 's' Parameter