WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
sheets-to-wp-table-live-sync
Published
2025-12-15
Title
FlexTable Google Sheets Connector < 3.19.2 - Admin+ Stored XSS
Slug
shelf-planner
Published
2025-11-10
Title
Shelf Planner < 2.8.2 - Missing Authorization to Unauthenticated Settings Update
Slug
shelf-planner
Published
2025-11-10
Title
Shelf Planner <= 2.7.0 - Unauthenticated Information Exposure via Log Files
Slug
shibboleth
Published
2016-03-02
Title
Shibboleth <= 1.7 - Cross-Site Scripting (XSS)
Slug
shiftcontroller
Published
2023-04-13
Title
ShiftController Employee Shift Scheduling < 4.9.26 - Reflected Cross-Site Scripting
Slug
shiftcontroller
Published
2023-11-12
Title
ShiftController Employee Shift Scheduling < 4.9.24 - CSRF
Slug
shiftcontroller
Published
2024-05-16
Title
ShiftController Employee Shift Scheduling < 4.9.58 - Authenticated (Contributor+) PHP Object Injection
Slug
shiftcontroller
Published
2024-09-23
Title
ShiftController Employee Shift Scheduling < 4.9.65 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
shiftcontroller
Published
2024-10-03
Title
ShiftController Employee Shift Scheduling < 4.9.67 - Reflected Cross-Site Scripting
Slug
shiftnav-responsive-mobile-menu
Published
2022-12-28
Title
ShiftNav – Responsive Mobile Menu < 1.7.2 - Contributor+ Stored XSS in Shortcode
Slug
shiftnav-responsive-mobile-menu
Published
2025-06-05
Title
ShiftNav – Responsive Mobile Menu < 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
shine-pdf
Published
2024-11-20
Title
Shine PDF Embeder <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
shiny-buttons
Published
2021-11-15
Title
Shiny Buttons <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting
Slug
ship-depot
Published
2025-04-01
Title
ShipDepot for WooCommerce <= 1.2.19 - Missing Authorization
Slug
ship-per-product
Published
2025-04-01
Title
Ship Per Product <= 2.1.0 - Missing Authorization
Slug
ship-to-ecourier
Published
2021-05-05
Title
Ship To Ecourier < 1.0.2 - Plugin's Settings Update via CSRF
Slug
shipdeo-woo
Published
2025-01-16
Title
Shipdeo <= 1.2.8 - Reflected Cross-Site Scripting
Slug
shipengine-shipping-quotes
Published
2025-02-11
Title
ShipEngine Shipping Quotes < 1.0.8 - Unauthenticated SQL Injection
Slug
shipment-tracker-for-woocommerce
Published
2024-12-19
Title
Shipment Tracker for Woocommerce < 1.4.23.1 - Reflected Cross-Site Scripting
Slug
shipping-labels-for-woo
Published
2024-04-22
Title
WooCommerce Shipping Label < 2.3.9 - Authenticated (Shop Manager+) Stored Cross-Site Scripting
Slug
shipping-manager-for-woocommerce
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
shipping-manager-for-woocommerce
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
shiptimize-for-woocommerce
Published
2024-12-05
Title
Shiptimize for WooCommerce <= 3.1.86 - Reflected Cross-Site Scripting
Slug
shiptimize-for-woocommerce
Published
2025-04-01
Title
Shiptimize for WooCommerce <= 3.1.86 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Slug
shipworks-e-commerce-bridge
Published
2025-01-17
Title
ShipWorks Connector for Woocommerce < 5.2.6 - Cross-Site Request Forgery to Service Password/Username Update