WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
quentn-wp
Published
2026-03-20
Title
Quentn WP < 1.2.13 - Unauthenticated SQL Injection via 'qntn_wp_access' Cookie
Slug
quentn-wp
Published
2026-09-07
Title
Quentn WP 1.2.13 - 1.2.14 - Unauthenticated SQLi via 'qntn_wp' Parameter
Slug
quentn-wp
Published
2026-09-07
Title
Quentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' Parameter
Slug
query-monitor
Published
2026-03-30
Title
Query Monitor < 3.20.4 - Reflected Cross-Site Scripting via Request URI
Slug
query-posts
Published
2025-09-28
Title
Query Posts <= 0.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
query-shortcode
Published
2026-05-26
Title
Query Shortcode <= 0.2.1 - Authenticated (Contributor+) Local File Inclusion via 'lens' Shortcode Attribute
Slug
query-wrangler
Published
2023-08-16
Title
Query Wrangler < 1.5.52 - Reflected XSS
Slug
query-wrangler
Published
2025-04-01
Title
Query Wrangler < 1.5.55 - Cross-Site Request Forgery
Slug
query-wrangler
Published
2026-07-22
Title
Query Wrangler < 1.5.58 - Missing Authorization
Slug
query-wrangler
Published
2026-08-15
Title
Query Wrangler < 1.5.58 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter
Slug
query-wrangler
Published
2026-08-19
Title
Query Wrangler < 1.5.58 - Authenticated (Subscriber+) Remote Code Execution
Slug
querywall
Published
2023-05-26
Title
QueryWall: Plug'n Play Firewall <= 1.1.1 - Admin+ SQLi
Slug
question-answer
Published
2025-04-01
Title
Question Answer <= 1.2.70 - Missing Authorization
Slug
question-answer
Published
2025-04-10
Title
Question Answer < 1.2.71 - Reflected Cross-Site Scripting
Slug
question-answer
Published
2025-04-14
Title
Question Answer <= 1.2.70 - Authenticated (Subscriber+) PHP Object Injection
Slug
question-answer
Published
2026-07-27
Title
PickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter
Slug
questionar-elementor
Published
2025-12-31
Title
Questionar for Elementor <= 1.1.7 - Missing Authorization
Slug
questionpro-surveys
Published
2026-02-13
Title
QuestionPro Surveys <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
quform
Published
2024-11-08
Title
Quform - WordPress Form Builder < 2.21.0 - Unauthenticated Sensitive Information Exposure
Slug
quform
Published
2026-06-25
Title
Quform - WordPress Form Builder < 2.23.1 - Authenticated (Subscriber+) Arbitrary File Upload
Slug
quick-adsense
Published
2022-04-02
Title
Quick Adsense < 2.8.2 - Subscriber+ Post Stats Reset
Slug
quick-adsense-reloaded
Published
2024-09-25
Title
Ads by WPQuads – Adsense Ads, Banner Ads, Popup Ads < 2.0.85 - Missing Authorization
Slug
quick-adsense-reloaded
Published
2025-03-27
Title
Ads by WPQuads < 2.0.88 - Unauthenticated SQL Injection
Slug
quick-adsense-reloaded
Published
2025-03-27
Title
Ads by WPQuads < 2.0.88 - Missing Authorization
Slug
quick-adsense-reloaded
Published
2025-09-22
Title
Ads by WPQuads <= 2.0.94 - Authenticated (Administrator+) Stored Cross-Site Scripting