WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
sheet2site
Published
2025-04-01
Title
Sheet2Site <= 1.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
sheetdb
Published
2025-04-01
Title
SheetDB < 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
sheetlink
Published
2025-09-22
Title
GSheets Connector <= 1.1.1 - Authenticated (Administrator+) PHP Object Injection
Slug
sheetpress
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
sheetpress
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
sheets-to-wp-table-live-sync
Published
2024-05-03
Title
Sheets To WP Table Live Sync < 3.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
sheets-to-wp-table-live-sync
Published
2025-12-15
Title
FlexTable Google Sheets Connector < 3.19.2 - Admin+ Stored XSS
Slug
sheets-to-wp-table-live-sync
Published
2026-05-25
Title
FlexTable – Data Table Sync with Google Sheets < 3.24.1 - Missing Authorization
Slug
sheets2table
Published
2026-03-20
Title
Sheets2Table <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titles' Shortcode Attribute
Slug
shelf-planner
Published
2025-11-10
Title
Shelf Planner < 2.8.2 - Missing Authorization to Unauthenticated Settings Update
Slug
shelf-planner
Published
2025-11-10
Title
Shelf Planner <= 2.7.0 - Unauthenticated Information Exposure via Log Files
Slug
sherk-custom-post-type-displays
Published
2026-03-20
Title
Sherk Custom Post Type Displays <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
Slug
shibboleth
Published
2016-03-02
Title
Shibboleth <= 1.7 - Cross-Site Scripting (XSS)
Slug
shibboleth
Published
2026-06-24
Title
Shibboleth < 2.5.4 - Unauthenticated Administrator Account Creation via Identity Header Spoofing
Slug
shiftcontroller
Published
2023-04-13
Title
ShiftController Employee Shift Scheduling < 4.9.26 - Reflected Cross-Site Scripting
Slug
shiftcontroller
Published
2023-11-12
Title
ShiftController Employee Shift Scheduling < 4.9.24 - CSRF
Slug
shiftcontroller
Published
2024-05-16
Title
ShiftController Employee Shift Scheduling < 4.9.58 - Authenticated (Contributor+) PHP Object Injection
Slug
shiftcontroller
Published
2024-09-23
Title
ShiftController Employee Shift Scheduling < 4.9.65 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
shiftcontroller
Published
2024-10-03
Title
ShiftController Employee Shift Scheduling < 4.9.67 - Reflected Cross-Site Scripting
Slug
shiftnav-responsive-mobile-menu
Published
2022-12-28
Title
ShiftNav – Responsive Mobile Menu < 1.7.2 - Contributor+ Stored XSS in Shortcode
Slug
shiftnav-responsive-mobile-menu
Published
2025-06-05
Title
ShiftNav – Responsive Mobile Menu < 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
shine-pdf
Published
2024-11-20
Title
Shine PDF Embeder <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
shiny-buttons
Published
2021-11-15
Title
Shiny Buttons <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting
Slug
shinystat-analytics
Published
2026-07-08
Title
ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosure
Slug
ship-depot
Published
2025-04-01
Title
ShipDepot for WooCommerce <= 1.2.19 - Missing Authorization