WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
siteorigin-panels
Published
2026-06-26
Title
Page Builder by SiteOrigin < 2.34.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via panels_data Parameter
Slug
siteorigin-panels
Published
2026-09-30
Title
Page Builder by SiteOrigin < 2.36.1 - Authenticated (Editor+) PHP Object Injection
Slug
siteorigin-panels
Published
2026-10-26
Title
Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class
Slug
siteorigin-panels
Published
2026-10-26
Title
Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments
Slug
sitepact-klaviyo-contact-form-7
Published
2024-02-15
Title
Sitepact's Contact Form 7 Extension For Klaviyo < 3.0.0 - Unauthenticated SQL Injection
Slug
sitepress-multilingual-cms
Published
2015-03-12
Title
WPML < 3.1.9 - Multiple Vulnerabilities (Including SQLi)
Slug
sitepress-multilingual-cms
Published
2015-09-02
Title
WPML 2.9.3-3.2.6 - Cross-Site Scripting (XSS) in Accept-Language Header
Slug
sitepress-multilingual-cms
Published
2018-10-08
Title
WPML < 4.0 - Unauthenticated Stored Cross-Site Scripting (XSS)
Slug
sitepress-multilingual-cms
Published
2020-03-09
Title
WPML < 4.3.7 - Authenticated Cross Site Request Forgery leading to Remote Code Execution
Slug
sitepress-multilingual-cms
Published
2022-11-09
Title
WPML < 4.5.14 - CSRF
Slug
sitepress-multilingual-cms
Published
2022-11-09
Title
WPML < 4.5.11 - Subscriber+ Settings Update
Slug
sitepress-multilingual-cms
Published
2022-11-09
Title
WPML < 4.5.11 - Subscriber+ Translation Job Status Update
Slug
sitepress-multilingual-cms
Published
2023-04-16
Title
WPML Multilingual CMS < 4.6.1 - Reflected Cross-Site Scripting
Slug
sitepress-multilingual-cms
Published
2024-08-21
Title
WPML Multilingual CMS < 4.6.13 - Contributor+ RCE via Twig Server-Side Template Injection
Slug
sitepress-multilingual-cms
Published
2025-05-01
Title
WPML Multilingual CMS 3.6.0 - 4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpml_language_switcher Shortcode
Slug
sitepress-multilingual-cms
Published
2026-08-14
Title
WPML Multilingual CMS < 4.9.6 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter
Slug
sitepress-multilingual-cms
Published
2026-09-07
Title
WPML Multilingual CMS < 4.9.6 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’
Slug
siteseo
Published
2025-08-26
Title
SiteSEO – SEO Simplified < 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Broken Regex Expression
Slug
siteseo
Published
2025-10-31
Title
SiteSEO < 1.3.2 - Author+ Plugin Settings Update
Slug
siteseo
Published
2025-11-18
Title
SiteSEO – SEO Simplified < 1.3.3 - Sensitive Post Meta Disclosure via IDOR
Slug
siteseo
Published
2025-11-18
Title
SiteSEO – SEO Simplified < 1.3.3 - Authenticated Settings Reset
Slug
siteskite
Published
2026-09-09
Title
SiteSkite MCP AI – Connector for Claude, ChatGPT, Cursor & WordPress WebOps < 2.1.6 - Unauthenticated Privilege Escalation
Slug
siteskite
Published
2026-09-23
Title
SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP < 2.1.8 - Authenticated (Contributor+) Insecure Direct Object Reference
Slug
siteskite
Published
2026-09-29
Title
SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP < 2.2.0 - Unauthenticated Remote Code Execution
Slug
sitespeaker-widget
Published
2025-09-22
Title
SiteNarrator Text-to-Speech Widget <= 1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting