WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
smtp2go
Published
2026-05-27
Title
SMTP2GO for WordPress < 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Log Read/Truncate
Slug
smugmug-embed
Published
2026-10-09
Title
SmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbums
Slug
snap-finance-checkout
Published
2026-10-16
Title
Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions
Slug
snap-finance-checkout
Published
2026-10-16
Title
Snap Finance < 3.12.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_payment
Slug
snap-pixel
Published
2023-09-27
Title
Snap Pixel < 1.5.8 - Admin+ Stored XSS
Slug
snap-pixel
Published
2023-10-16
Title
Snap Pixel < 1.6.0 - Arbitrary Settings Update via CSRF
Slug
snapapp
Published
2014-04-25
Title
Snapapp <= 1.5 - Multiple Cross-Site Scripting (XSS)
Slug
snapshot-backup
Published
2024-08-19
Title
Snapshot Backup <= 2.1.1 - Stored XSS via CSRF
Slug
snapshotify
Published
2026-10-05
Title
Snapshotify – All-in-One Backup & Restore & Migrate < 1.3.7 - Unauthenticated Information Exposure
Slug
snapwidget-wp-instagram-widget
Published
2025-04-01
Title
SnapWidget Social Photo Feed Widget <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
snapwidget-wp-instagram-widget
Published
2025-09-22
Title
SnapWidget Social Photo Feed Widget <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
snazzy-archives
Published
2014-08-01
Title
snazzy-archives <= 1.7.1 - swf/tagcloud.swf tagcloud Parameter XSS
Slug
snazzy-cacheable-facebook-feed
Published
2026-10-13
Title
Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter
Slug
snazzy-maps
Published
2018-07-24
Title
Snazzy Maps < 1.1.5 - Multiple Cross-Site Scripting (XSS)
Slug
snazzyadmin-wp-admin-theme
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
snazzyadmin-wp-admin-theme
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
snazzyadmin-wp-admin-theme
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
sneeit-framework
Published
2025-11-24
Title
Sneeit Framework < 8.4 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback
Slug
snillrik-restaurant-menu
Published
2026-01-06
Title
Snillrik Restaurant < 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'menu_style' Shortcode Attribute
Slug
snipe-nginx-cache
Published
2025-01-16
Title
Cache Sniper for Nginx <= 1.0.4.2 - Missing Authorization
Slug
sniplets
Published
2014-08-01
Title
Sniplets 1.1.2 - (RFI/XSS/RCE) Multiple Vulnerabilities
Slug
snippy
Published
2025-01-16
Title
Snippy <= 1.4.1 - Reflected Cross-Site Scripting
Slug
snow-monkey-blocks
Published
2026-05-05
Title
Snow Monkey Blocks < 24.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-slick' Attribute
Slug
snow-monkey-forms
Published
2023-05-15
Title
Snow Monkey Forms < 5.0.7 - Unauthenticated Path Traversal
Slug
snow-monkey-forms
Published
2026-01-27
Title
Snow Monkey Forms < 12.0.4 - Unauthenticated Arbitrary File Deletion