WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
subscriptiondna
Published
2025-01-24
Title
Subscription DNA < 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
subscriptions-memberships-for-paypal
Published
2021-10-11
Title
Multiple Plugins from WPPlugin - Reflected Cross-Site Scripting via page Parameter
Slug
subscriptions-memberships-for-paypal
Published
2025-02-25
Title
Subscriptions & Memberships for PayPal < 1.1.7 - Cross-Site Request Forgery to Arbitrary Post Deletion
Slug
subscriptions-memberships-for-paypal
Published
2025-11-21
Title
Subscriptions & Memberships for PayPal < 1.1.8 - Unauthenticated Fake Payment Creation
Slug
subscriptions-memberships-for-paypal
Published
2025-11-28
Title
Subscriptions & Memberships for PayPal < 1.1.8 - Missing Authorization
Slug
subscriptions-renewal-reminders
Published
2025-06-05
Title
Subscription Renewal Reminders for WooCommerce < 1.4.2 - Notice Dismissal via CSRF
Slug
subway
Published
2024-04-29
Title
Subway – Private Site Option <= 2.1.4 - Improper Access Control to Sensitive Information Exposure via REST API
Slug
sucuri-scanner
Published
2022-09-14
Title
Sucuri Security < 1.8.34 - Event log Entry Creation via CSRF
Slug
suevafree-essential-kit
Published
2024-11-20
Title
SuevaFree Essential Kit < 1.1.4 - Contributor+ Stored XSS
Slug
sugar-calendar-lite
Published
2024-11-19
Title
Sugar Calendar (Lite) < 3.4.0 - Reflected Cross-Site Scripting
Slug
suki-sites-import
Published
2024-10-17
Title
Suki Sites Import <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
sully
Published
2024-06-22
Title
SULly < 4.3.1 - Admin+ Stored XSS
Slug
sully
Published
2024-06-22
Title
SULly < 4.3.1 - Reflected XSS
Slug
sully
Published
2024-06-22
Title
SULly < 4.3.1 - Admin+ Stored XSS via CSRF
Slug
sully
Published
2024-06-22
Title
SULly < 4.3.1 - Plugin Reset via CSRF
Slug
sumo-divi-modules
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
sumo-divi-modules
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
sumome
Published
2024-04-05
Title
Sumo < 1.35 - Cross-Site Request Forgery
Slug
sumomemberships
Published
2025-10-15
Title
SUMO Memberships for WooCommerce < 7.8.0 - Cross-Site Request Forgery
Slug
sumomemberships
Published
2025-08-27
Title
SUMO Memberships for WooCommerce < 7.8.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
Slug
sumomemberships
Published
2025-08-21
Title
SUMO Memberships for WooCommerce <= 7.8.0 - Subscriber+ Privilege Escalation
Slug
sunshine-photo-cart
Published
2021-06-08
Title
CSRF Bypass in Multiple Plugins
Slug
sunshine-photo-cart
Published
2022-12-15
Title
Sunshine Photo Cart < 2.9.15 - Reflected XSS
Slug
sunshine-photo-cart
Published
2022-12-01
Title
Sunshine Photo Cart Plugin < 2.9.14 - Image Location Update via CSRF
Slug
sunshine-photo-cart
Published
2023-09-05
Title
Sunshine Photo Cart < 3.0 - Insecure Direct Object Reference to Order Manipulation