WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
textme-sms-integration
Published
2021-08-24
Title
TextME SMS < 1.8.9 - Authenticated Stored XSS
Slug
textme-sms-integration
Published
2023-11-23
Title
TextMe SMS < 1.9.1 - Subscriber+ Settings Update
Slug
textme-sms-integration
Published
2025-04-03
Title
TextMe SMS < 1.9.2 - Missing Authorization
Slug
tf-numbers-number-counter-animaton
Published
2023-03-27
Title
TF Random Numbers < 2.0.1 - Subscriber+ Arbitrary Option Update
Slug
tf-woo-product-grid
Published
2025-09-23
Title
TF Woo Product Grid Addon For Elementor <= 1.0.1 - Unauthenticated PHP Object Injection
Slug
tgg-wp-optimizer
Published
2025-03-28
Title
TGG WP Optimizer <= 1.25 - Admin+ Stored XSS
Slug
th-variation-swatches
Published
2025-01-22
Title
Variation Swatches for WooCommerce 1.0.8 - 1.3.2 - Cross-Site Request Forgery to Plugin Settings Reset
Slug
th-wishlist
Published
2025-11-24
Title
Wishlist for WooCommerce < 1.1.4 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
Slug
th23-social
Published
2022-04-19
Title
th23 Social <= 1.2.0 - Admin+ Stored Cross-Site Scripting
Slug
thai-lottery-widget
Published
2025-12-04
Title
Thai Lottery Widget <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
thank-me-later
Published
2022-03-28
Title
Thank Me Later <= 3.3.4 - Admin+ Stored Cross-Site Scripting
Slug
thanks-you-counter-button
Published
2014-08-01
Title
Thank You Counter Button - Multiple Stored Cross-Site Scripting (XSS)
Slug
thanks-you-counter-button
Published
2014-08-01
Title
Thank You Counter Button <= 1.8.2 - Cross-Site Scripting (XSS)
Slug
the-buffer-button
Published
2022-01-18
Title
The Buffer Button <= 1.0 - Authenticated Stored Cross Site Scripting (XSS)
Slug
the-casengo-chat-widget
Published
2025-09-22
Title
Casengo Live Chat Support <= 2.1.4 - Cross-Site Request Forgery
Slug
the-countdown
Published
2025-06-25
Title
The Countdown <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via clientId Parameter
Slug
the-events-calendar
Published
2014-08-01
Title
The Events Calendar <= 3.0 - Reflected Cross-Site Scripting (XSS)
Slug
the-events-calendar
Published
2016-04-25
Title
The Events Calendar <= 4.1.1 - Open Redirect
Slug
the-events-calendar
Published
2019-03-04
Title
The Events Calendar < 4.8.2 - XSS
Slug
the-events-calendar
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
the-events-calendar
Published
2022-02-15
Title
The Events Calendar < 5.14.0 - Reflected Cross-Site Scripting
Slug
the-events-calendar
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
the-events-calendar
Published
2023-11-23
Title
The Events Calendar < 6.2.8.1 - Unauthenticated Arbitrary Password Protected Post Read
Slug
the-events-calendar
Published
2024-01-12
Title
The Events Calendar < 6.2.9 - Unauthenticated Sensitive Information Exposure
Slug
the-events-calendar
Published
2024-05-14
Title
The Events Calendar < 6.4.0.1 - Reflected XSS