WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
ultimate-product-catalogue
Published
2023-06-05
Title
Ultimate Product Catalog < 5.2.6 - Admin+ Stored XSS
Slug
ultimate-product-catalogue
Published
2024-04-10
Title
Ultimate Product Catalogue < 5.2.16 - Cross-Site Request Forgery via reset_settings()
Slug
ultimate-profile-builder
Published
2015-05-06
Title
Ultimate Profile Builder By CMSHelpLive < 3.0 - CSRF/XSS
Slug
ultimate-push-notifications
Published
2025-04-01
Title
Ultimate Push Notifications <= 1.2.0 - Reflected Cross-Site Scripting
Slug
ultimate-push-notifications
Published
2025-03-31
Title
Ultimate Push Notifications <= 1.2.0 - Subscriber+ SQL Injection
Slug
ultimate-push-notifications
Published
2025-07-07
Title
Ultimate Push Notifications <= 1.2.0 - Missing Authorization
Slug
ultimate-responsive-image-slider
Published
2023-11-23
Title
Slider - Ultimate Responsive Image Slider < 3.5.12 - Subscriber+ Arbitrary Post Access
Slug
ultimate-reviews
Published
2020-11-10
Title
Ultimate Reviews < 2.1.33 - Unauthenticated PHP Object Injection
Slug
ultimate-reviews
Published
2022-01-06
Title
Ultimate Reviews < 3.0.16 - Admin+ Stored Cross-Site Scripting
Slug
ultimate-reviews
Published
2024-02-12
Title
Ultimate Reviews < 3.2.9 - Unauthenticated stored Cross-Site Scripting via reviews
Slug
ultimate-reviews
Published
2025-06-11
Title
Ultimate Reviews < 3.2.15 - Reflected Cross-Site Scripting
Slug
ultimate-reviews
Published
2026-01-06
Title
Ultimate Reviews < 3.2.17 - Unauthenticated Insecure Direct Object Reference
Slug
ultimate-security-checker
Published
2025-03-28
Title
Ultimate Security Checker <= 4.2 - Cross-Site Request Forgery
Slug
ultimate-shortcodes-creator
Published
2024-11-04
Title
Shortcodes Blocks Creator Ultimate < 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
ultimate-shortcodes-creator
Published
2024-12-06
Title
Shortcodes Blocks Creator Ultimate <= 2.2.0 - Reflected Cross-Site Scripting via 'page'
Slug
ultimate-shortcodes-creator
Published
2024-12-06
Title
Shortcodes Blocks Creator Ultimate <= 2.2.0 - Reflected Cross-Site Scripting via _wpnonce
Slug
ultimate-sms-notifications
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
ultimate-sms-notifications
Published
2020-12-18
Title
Ultimate SMS Notifications for WooCommerce < 1.4.2 - CSV Injection
Slug
ultimate-sms-notifications
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
ultimate-social-media-icons
Published
2015-05-30
Title
Social Media & Share Icons <= 1.1.1.11 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
ultimate-social-media-icons
Published
2019-03-29
Title
Social Media & Share Icons < 2.2.0 - Multiple Issues
Slug
ultimate-social-media-icons
Published
2023-06-05
Title
Social Media Share Buttons & Social Sharing Icons < 2.8.2 - Admin+ Stored XSS
Slug
ultimate-social-media-icons
Published
2023-07-27
Title
Multiple Plugins from Inisev - Subscriber+ Plugin Installation
Slug
ultimate-social-media-icons
Published
2023-07-27
Title
Multiple Plugins from Inisev - Plugin Installation via CSRF
Slug
ultimate-social-media-icons
Published
2023-08-29
Title
Social Media & Share Icons < 2.8.4 - Reflected XSS