WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
reflex-gallery
Published
2014-08-01
Title
ReFlex Gallery 1.3 - Shell Upload
Slug
reflex-gallery
Published
2015-03-16
Title
Reflex Gallery <= 3.1.3 - Arbitrary File Upload
Slug
reflex-gallery
Published
2015-05-14
Title
Multiple Plugins - jQuery prettyPhoto DOM Cross-Site Scripting (XSS)
Slug
reformer-elementor
Published
2025-06-11
Title
Reformer for Elementor <= 1.0.5 - Unauthenticated Arbitrary File Upload
Slug
reformer-elementor
Published
2025-12-11
Title
Reformer for Elementor <= 1.0.6 - Missing Authorization
Slug
reftagger-shortcode
Published
2024-10-31
Title
Reftagger Shortcode <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
refund-request-for-woocommerce
Published
2025-11-24
Title
Refund Request for WooCommerce <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Update
Slug
regallery
Published
2026-01-07
Title
Re Gallery < 1.18.10 - Missing Authorization
Slug
regenerate-post-permalinks
Published
2024-04-19
Title
Regenerate post permalink <= 1.0.3 - Cross-Site Request Forgery
Slug
register-ip-multisite
Published
2019-05-14
Title
Register IPs <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting (XSS)
Slug
register-plus
Published
2010-11-25
Title
Register Plus <= 3.5.1 - Multiple XSS
Slug
register-plus
Published
2010-11-25
Title
Register Plus <= 3.5.1 - Full Path Disclosure
Slug
register-plus-redux
Published
2014-08-01
Title
Register Plus Redux <= 3.8.3 - Cross-Site Scripting (XSS)
Slug
registered-user-sync-activecampaign
Published
2025-01-16
Title
User Sync ActiveCampaign <= 1.3.2 - Missing Authorization
Slug
registration-login-with-mobile-phone-number
Published
2025-12-30
Title
Registration & Login with Mobile Phone Number for WooCommerce < 1.3.2 - Missing Authorization
Slug
registration-login-with-mobile-phone-number
Published
2026-01-16
Title
Registration & Login with Mobile Phone Number for WooCommerce < 1.3.2 - Authentication Bypass
Slug
registration-password
Published
2026-01-05
Title
FS Registration Password < 2.0.1 - Unauthenticated Privilege Escalation via Account Takeover
Slug
registrations-for-the-events-calendar
Published
2021-10-27
Title
Registrations for The Events Calendar < 2.7.5 - Reflected Cross-Site Scripting
Slug
registrations-for-the-events-calendar
Published
2021-11-08
Title
Registrations for the Events Calendar < 2.7.6 - Unauthenticated SQL Injection
Slug
registrations-for-the-events-calendar
Published
2021-12-27
Title
Registrations for the Events Calendar < 2.7.10 - Reflected Cross-Site Scripting
Slug
registrations-for-the-events-calendar
Published
2024-08-07
Title
Registrations for the Events Calendar < 2.12.2 - Missing Authorization
Slug
registrations-for-the-events-calendar
Published
2024-07-30
Title
Registrations for the Events Calendar – Event Registration Plugin < 2.12.3 - Authenticated (Contributor+) SQL Injection
Slug
registrations-for-the-events-calendar
Published
2024-10-18
Title
Registrations for The Events Calendar < 2.12.4 - Unauthenticated Stored XSS
Slug
registrations-for-the-events-calendar
Published
2025-03-03
Title
Registrations for The Events Calendar < 2.13.4 - Admin+ Stored XSS
Slug
reglevel
Published
2024-07-17
Title
RegLevel <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting