WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
simple-tags
Published
2025-12-05
Title
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI < 3.41.0 - Authenticated (Contributor+) SQL Injection via ORDER BY Clause
Slug
simple-tags
Published
2026-01-05
Title
TaxoPress < 3.42.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Tag Modification
Slug
simple-testimonials-showcase
Published
2023-11-23
Title
Simple Testimonials Showcase <= 1.1.5 - Cross-Site Request Forgery
Slug
simple-testimonials-showcase
Published
2024-04-15
Title
Simple Testimonials Showcase <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
simple-testimonials-showcase
Published
2024-10-15
Title
Simple Testimonials Showcase <= 1.1.6 - Authenticated (Editor+) Stored Cross-Site Scripting
Slug
simple-text-slider
Published
2025-09-05
Title
Simple Text Slider <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
simple-theme-changer
Published
2025-12-11
Title
Simple Theme Changer <= 1.0. - Missing Authorization to Plugin Settings Update via AJAX Actions
Slug
simple-theme-changer
Published
2025-12-11
Title
Simple Theme Changer <= 1.0 - Cross-Site Request Forgery to Arbitrary Theme Switcher Configuration Update
Slug
simple-theme-options
Published
2022-02-21
Title
Simple Theme Options < 1.7 - Admin+ Stored Cross-Site Scripting
Slug
simple-tooltips
Published
2023-01-16
Title
Simple Tooltips < 2.1.4 - Contributor+ Stored XSS via Shortcode
Slug
simple-tooltips
Published
2023-04-19
Title
Simple Tooltips <= 2.1.4 - Admin+ Stored XSS
Slug
simple-tour-guide
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
simple-trackback-disabler
Published
2025-03-28
Title
Simple Trackback Disabler <= 1.4 - Cross-Site Request Forgery
Slug
simple-travel-map
Published
2024-11-22
Title
Simple Travel Map <= 0.1 - Cross-Site Request Forgery
Slug
simple-tweet
Published
2023-10-12
Title
Simple Tweet <= 1.4.0.2 - Admin+ Stored XSS
Slug
simple-tweet
Published
2024-02-27
Title
Simple Tweet <= 1.4.0.2 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
simple-urls
Published
2023-01-17
Title
Simple URLs < 115 - Multiple Reflected XSS
Slug
simple-urls
Published
2023-01-17
Title
Simple URLs < 115 - Subscriber+ SQLi
Slug
simple-urls
Published
2023-08-21
Title
Simple URLs < 118 - Reflected XSS
Slug
simple-urls
Published
2023-10-16
Title
Simple URLs < 121 - Arbitrary Actions via CSRF
Slug
simple-user-capabilities
Published
2025-11-03
Title
Simple User Capabilities <= 1.0 - Missing Authorization to Unauthenticated Capability Reset
Slug
simple-user-capabilities
Published
2025-11-03
Title
Simple User Capabilities <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Slug
simple-user-listing
Published
2023-10-25
Title
Simple User Listing < 1.9.3 - Reflected XSS
Slug
simple-user-meta-editor
Published
2026-01-06
Title
Simple User Meta Editor <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via User Meta Value Field
Slug
simple-user-profile
Published
2025-02-03
Title
Simple User Profile <= 1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting