WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
sfwd-lms
Published
2023-10-31
Title
LearnDash LMS < 4.5.3.1 - SQL Injection
Slug
sfwd-lms
Published
2024-02-02
Title
LearnDash LMS < 4.10.2 - Sensitive Information Exposure via API
Slug
sfwd-lms
Published
2024-02-02
Title
LearnDash LMS < 4.10.2 - Sensitive Information Exposure via assignments
Slug
sfwd-lms
Published
2024-02-02
Title
LearnDash LMS < 4.10.3 - Sensitive Information Exposure via API
Slug
sfwd-lms
Published
2025-01-24
Title
LearnDash LMS < 4.20.0.3 - Missing Authorization
Slug
sfwd-lms
Published
2026-03-23
Title
LearnDash LMS < 5.0.3.1 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter
Slug
sg-cachepress
Published
2019-03-14
Title
SG Optimizer <= 5.0.12 - Unauthenticated File Upload
Slug
sg-helper
Published
2024-12-03
Title
SG Helper <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload
Slug
sg-security
Published
2022-04-07
Title
SiteGround Security < 1.2.6 - Authentication Bypass via 2-FA Authentication Setup
Slug
sg-security
Published
2022-04-07
Title
SiteGround Security < 1.2.6 - Authorization Weakness to Authentication Bypass via 2-FA Back-up Codes
Slug
sg-security
Published
2023-01-13
Title
SiteGround Security < 1.3.1 - Admin+ SQLi
Slug
sg-security
Published
2024-07-19
Title
Security Optimizer – The All-In-One Protection Plugin < 1.5.1 - Missing Authorization via hide_notice()
Slug
sg-security
Published
2025-11-30
Title
SiteGround Security <= 1.5.8 - Missing Authorization
Slug
sh-contextual-help
Published
2025-11-03
Title
SH Contextual Help <= 3.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
sh-email-alert
Published
2025-03-25
Title
SH Email Alert <= 1.0 - Reflected Cross-Site Scripting
Slug
sh-slideshow
Published
2014-08-01
Title
SH Slideshow <= 3.1.4 - SQL Injection
Slug
sh-slideshow
Published
2024-11-01
Title
SH Slideshow <= 4.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
shabat-keeper
Published
2026-01-08
Title
Shabat Keeper <= 0.4.4 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Slug
shabbos-and-yom-tov
Published
2025-01-16
Title
Shabbos and Yom Tov <= 1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
shalom-world-media-gallery
Published
2025-02-02
Title
SW Plus <= 2.1 - Reflected Cross-Site Scripting
Slug
shantz-wordpress-qotd
Published
2021-07-19
Title
Shantz WordPress QOTD <= 1.2.2 - Arbitrary Setting Update via CSRF
Slug
shapepress-dsgvo
Published
2019-08-27
Title
Shapepress DSGVO < 2.2.19 - Authenticated Reflected XSS
Slug
shapepress-dsgvo
Published
2021-09-24
Title
WP DSGVO Tools (GDPR) < 3.1.24 - Unauthenticated Plugin's Settings Update to Stored Cross-Site Scripting
Slug
shapepress-dsgvo
Published
2021-11-02
Title
WP DSGVO Tools (GDPR) < 3.1.24 - Unauthenticated Arbitrary Post Deletion
Slug
shapepress-dsgvo
Published
2024-05-22
Title
WP DSGVO Tools (GDPR) < 3.1.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode