WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
ultimate-weather-plugin
Published
2014-04-25
Title
Ultimate Weather Plugin <= 1.0 - Unauthenticated Reflected XSS
Slug
ultimate-widgets-light
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
ultimate-widgets-light
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
ultimate-widgets-light
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
ultimate-woocommerce-auction-pro
Published
2025-05-01
Title
Ultimate Auction Pro < 1.5.3 - Unauthenticated SQL Injection via 'auction_id'
Slug
ultimate-wp-mail
Published
2025-04-09
Title
Ultimate WP Mail <= 1.3.9 - Open Redirect
Slug
ultimate-wp-mail
Published
2025-05-07
Title
Ultimate WP Mail < 1.3.5 - Cross-Site Request Forgery
Slug
ultimate-wp-mail
Published
2025-05-07
Title
Ultimate WP Mail < 1.3.5 - Authenticated (Contributor+) SQL Injection
Slug
ultimate-wp-mail
Published
2025-06-05
Title
Ultimate WP Mail < 1.3.6 - Missing Authorization
Slug
ultimate-wp-mail
Published
2025-07-15
Title
Ultimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function
Slug
ultimate-wp-mail
Published
2025-09-22
Title
Ultimate WP Mail < 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
ultimate-wp-query-search-filter
Published
2023-02-15
Title
Ultimate WP Query Search Filter <= 1.0.10 - Contributor+ XSS
Slug
ultimate-youtube-video-player
Published
2024-11-20
Title
Ultimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Playlist/Video Deletion
Slug
ultimate-youtube-video-player
Published
2024-11-21
Title
Ultimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Setting Exposure
Slug
ultimate_vc_addons
Published
2017-05-15
Title
Ultimate Addons for Visual Composer < 3.16.12 - Authenticated XSS, CSRF, RCE
Slug
ultimate_vc_addons
Published
2023-10-19
Title
Ultimate Addons for WPBakery Page Builder < 3.19.15 - Authenticated(Contributor+) Local File Inclusion
Slug
ultimate_vc_addons
Published
2023-12-26
Title
Ultimate Addons for WPBakery < 3.19.18 - Cross-Site Request Forgery
Slug
ultimatewoo
Published
2021-05-07
Title
UltimateWoo <= 0.1.10 - PHP Object Injection
Slug
ultimeter
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
ultimeter
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
ultimeter
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
ultra-companion
Published
2024-01-31
Title
Ultra Companion < 1.2.0 - Contributor+ Stored XSS
Slug
ultra-elementor-addons
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
ultra-skype-button
Published
2025-12-05
Title
Ultra Skype Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_id' Shortcode Attribute
Slug
ultraaddons-elementor-lite
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting