WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
tuturn
Published
2025-10-15
Title
Tuturn < 3.6 - Authenticated (Subscriber+) Arbitrary File Download
Slug
tuturn
Published
2025-10-15
Title
Tuturn < 3.6 - Unauthenticated Missing Authorization
Slug
tuxedo-big-file-uploads
Published
2023-11-14
Title
Big File Uploads < 2.1.2 - Cross-Site Request Forgery via actions
Slug
tuxedo-big-file-uploads
Published
2024-09-06
Title
Big File Uploads < 2.1.3 - Authenticated (Author+) Full Path Disclosure
Slug
tw-image-hover-share
Published
2025-12-04
Title
Quantic Social Image Hover <= 1.0.8 - Cross-Site Request Forgery to Settings Update
Slug
tw-whatsapp-chat-rotator
Published
2025-09-18
Title
WhatsApp Chat for WordPress and WooCommerce <= 1.2.1 - Reflected Cross-Site Scripting
Slug
twb-woocommerce-reviews
Published
2023-11-07
Title
TWB Woocommerce Reviews < 1.7.6 - Admin+ Stored XSS
Slug
twb-woocommerce-reviews
Published
2025-03-27
Title
TWB Woocommerce Reviews < 1.7.8 - Cross-Site Request Forgery
Slug
twchat
Published
2021-10-05
Title
Two Way Chat < 3.1.5 - Admin+ Local File Inclusion
Slug
twchat
Published
2021-10-05
Title
Two Way Chat < 3.1.5 - Multiple CSRF
Slug
twchat
Published
2024-12-06
Title
TWChat – Send or receive messages from users <= 4.0.4 - Reflected Cross-Site Scripting
Slug
tweeple
Published
2023-10-18
Title
Tweeple <= 0.9.5 - Reflected XSS
Slug
tweet-blender
Published
2014-08-01
Title
Tweet Blender 4.0.1 - Unspecified XSS
Slug
tweet-old-custom-post
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
tweet-old-post
Published
2011-09-05
Title
Tweet Old Post <= 3.2.5 - Authenticated SQL Injection
Slug
tweet-old-post
Published
2015-02-02
Title
Revive Old Post < 6.9.4 - Privilege Escalation
Slug
tweet-old-post
Published
2023-01-04
Title
Revive Old Posts – Social Media Auto Post and Scheduling Plugin < 9.0.11 - PHP Object Injection
Slug
tweet-old-post
Published
2025-10-14
Title
Revive Old Posts < 9.3.4 - Missing Authorization
Slug
tweet-wheel
Published
2016-04-21
Title
Tweet Wheel <= 1.0.3.2 - Reflected Cross-Site Scripting (XSS)
Slug
tweetscribe
Published
2014-12-18
Title
Tweetscribe <= 1.1 - Multiple CSRF
Slug
tweetscroll-widget
Published
2024-04-30
Title
TweetScroll Widget <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
tweetthis-shortcode
Published
2025-09-25
Title
TweetThis Shortcode <= 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
twenty20
Published
2023-01-23
Title
Twenty20 Image Before-After <= 2.0.4 - Contributor+ Stored XSS
Slug
twentyfourth-wp-scraper
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
twentyfourth-wp-scraper
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting