WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
qr-master
Published
2025-04-07
Title
QR Master <= 1.0.5 - Reflected Cross-Site Scripting
Slug
qr-redirector
Published
2021-10-18
Title
QR Redirector < 1.6.1 - Contributor+ Stored Cross-Site Scripting
Slug
qr-redirector
Published
2021-10-18
Title
QR Redirector < 1.6 - Subscriber+ Arbitrary QR Redirect Response Status Update
Slug
qr-twitter-widget
Published
2023-10-18
Title
QR Twitter Widget <= 0.2.3 - Contributor+ Stored XSS
Slug
qrcode-wprhe
Published
2025-01-16
Title
QR Code Generator <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
qrmenu-lite
Published
2024-11-18
Title
QRMenu Restaurant QR Menu Lite <= 1.0.3 - Authenticated (Contributor+) PHP Object Injection
Slug
qs-dark-mode
Published
2024-09-30
Title
QS Dark Mode Plugin < 3.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
qs-dark-mode
Published
2025-05-07
Title
QS Dark Mode <= 3.0 - Missing Authorization
Slug
qt-kentharadio
Published
2021-06-28
Title
Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Unauthenticated RFI and SSRF
Slug
qtranslate
Published
2014-08-01
Title
qTranslate 2.5.34 - Setting Manipulation CSRF
Slug
qtranslate
Published
2015-07-29
Title
qTranslate <= 2.5.39 - Cross-Site Scripting (XSS)
Slug
qtranslate-slug
Published
2021-06-08
Title
CSRF Bypass in Multiple Plugins
Slug
qtranslate-slug
Published
2021-06-08
Title
Qtranslate Slug <= 1.1.18 - Cross-Site Request Forgery
Slug
qtranslate-x
Published
2015-08-21
Title
qTranslate X <= 3.4.3 - Authenticated Reflected Cross-Site Scripting (XSS)
Slug
qtranslate-x
Published
2021-08-31
Title
qTranslate X <= 3.4.6.8 - Multiple Admin+ Stored Cross-Site Scripting
Slug
quadmenu
Published
2021-02-22
Title
QuadMenu < 2.0.7 - Unauthenticated RCE via compiler_save
Slug
quadmenu
Published
2025-04-11
Title
WordPress Mega Menu – QuadMenu < 3.2.1 - Cross-Site Request Forgery to Limited User Meta Update
Slug
quantities-and-units-for-woocommerce
Published
2025-09-17
Title
Quantities and Units for WooCommerce <= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
quartz
Published
2014-09-27
Title
Quartz Plugin 1.01.1 - SQL Injection
Slug
quasar-form
Published
2023-07-24
Title
Quasar form <= 6.1 - Subscriber+ SQLi
Slug
qubely
Published
2021-12-27
Title
Qubely < 1.7.8 - Subscriber+ Arbitrary Post Deletion
Slug
qubely
Published
2022-06-06
Title
Qubely < 1.8.1 - Authenticated Arbitrary Settings Update
Slug
qubely
Published
2023-01-02
Title
Qubely < 1.8.5 - Contributor+ Stored XSS
Slug
qubely
Published
2023-07-17
Title
Qubely < 1.8.6 - Unauthenticated Arbitrary E-mail Sending
Slug
qubely
Published
2025-02-13
Title
Qubely – Advanced Gutenberg Blocks < 1.8.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' and 'UniqueID'