WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
subscribe2
Published
2023-06-26
Title
Subscribe2 – Form, Email Subscribers & Newsletters < 10.41 - Sending Emails via CSRF
Slug
subscribe2
Published
2025-02-18
Title
Subscribe2 – Form, Email Subscribers & Newsletters < 10.44 - Unauthenticated Stored Cross-Site Scripting via IP Parameter
Slug
subscribe2
Published
2026-02-03
Title
Subscribe2 < 10.45 - Missing Authorization
Slug
subscriber
Published
2017-04-12
Title
Multiple BestWebSoft Plugins - Authenticated Cross-Site Scripting (XSS)
Slug
subscribers-com
Published
2023-04-19
Title
Subscribers - Free Web Push Notifications < 1.5.4 - Admin+ Stored XSS
Slug
subscribers-text-counter
Published
2023-08-04
Title
Subscribers Text Counter < 1.7.1 - Settings Update via CSRF to Stored XSS
Slug
subscriptiondna
Published
2025-01-24
Title
Subscription DNA < 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
subscriptions-memberships-for-paypal
Published
2021-10-11
Title
Multiple Plugins from WPPlugin - Reflected Cross-Site Scripting via page Parameter
Slug
subscriptions-memberships-for-paypal
Published
2025-02-25
Title
Subscriptions & Memberships for PayPal < 1.1.7 - Cross-Site Request Forgery to Arbitrary Post Deletion
Slug
subscriptions-memberships-for-paypal
Published
2025-11-21
Title
Subscriptions & Memberships for PayPal < 1.1.8 - Unauthenticated Fake Payment Creation
Slug
subscriptions-memberships-for-paypal
Published
2025-11-28
Title
Subscriptions & Memberships for PayPal < 1.1.8 - Missing Authorization
Slug
subscriptions-renewal-reminders
Published
2025-06-05
Title
Subscription Renewal Reminders for WooCommerce < 1.4.2 - Notice Dismissal via CSRF
Slug
subway
Published
2024-04-29
Title
Subway – Private Site Option <= 2.1.4 - Improper Access Control to Sensitive Information Exposure via REST API
Slug
sucuri-scanner
Published
2022-09-14
Title
Sucuri Security < 1.8.34 - Event log Entry Creation via CSRF
Slug
suevafree-essential-kit
Published
2024-11-20
Title
SuevaFree Essential Kit < 1.1.4 - Contributor+ Stored XSS
Slug
sugar-calendar-lite
Published
2024-11-19
Title
Sugar Calendar (Lite) < 3.4.0 - Reflected Cross-Site Scripting
Slug
sugar-calendar-lite
Published
2026-01-05
Title
Sugar Calendar (Lite) <= 3.10.1 - Missing Authorization
Slug
suggestion-toolkit
Published
2026-01-10
Title
Suggestion Toolkit <= 5.0 - Missing Authorization
Slug
suki-sites-import
Published
2024-10-17
Title
Suki Sites Import <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
sully
Published
2024-06-22
Title
SULly < 4.3.1 - Admin+ Stored XSS
Slug
sully
Published
2024-06-22
Title
SULly < 4.3.1 - Reflected XSS
Slug
sully
Published
2024-06-22
Title
SULly < 4.3.1 - Admin+ Stored XSS via CSRF
Slug
sully
Published
2024-06-22
Title
SULly < 4.3.1 - Plugin Reset via CSRF
Slug
sumo-divi-modules
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
sumo-divi-modules
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting