WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
ultimeter
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
ultimeter
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
ultimeter
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
ultra-companion
Published
2024-01-31
Title
Ultra Companion < 1.2.0 - Contributor+ Stored XSS
Slug
ultra-elementor-addons
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
ultra-portfolio
Published
2026-01-21
Title
Ultra Portfolio <= 6.7 - Authenticated (Subscriber+) SQL Injection
Slug
ultra-skype-button
Published
2025-12-05
Title
Ultra Skype Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_id' Shortcode Attribute
Slug
ultraaddons-elementor-lite
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
ultraaddons-elementor-lite
Published
2024-07-09
Title
UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) < 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Slug
ultraaddons-elementor-lite
Published
2024-10-15
Title
UltraAddons Elementor Lite <= 2.0.2 - Author+ Stored XSS
Slug
ultraaddons-elementor-lite
Published
2024-11-20
Title
UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) < 1.1.9 - Insecure Direct Object Reference to Sensitive Information Exposure via UA_Template Shortcode
Slug
ultraaddons-elementor-lite
Published
2025-04-04
Title
UltraAddons <= 2.0.2 - Cross-Site Request Forgery
Slug
ultraaddons-elementor-lite
Published
2025-05-16
Title
UltraAddons Elementor Lite <= 2.0.2 - Contributor+ Stored XSS
Slug
ultraembed-advanced-iframe
Published
2025-02-18
Title
UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
umich-oidc-login
Published
2025-02-18
Title
UMich OIDC Login <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
uncanny-automator
Published
2023-12-28
Title
Uncanny Automator < 5.1.0.3 - Sensitive Information Exposure via Log File
Slug
uncanny-automator
Published
2025-03-11
Title
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin < 6.3 - Authenticated (Admin+) Server-Side Request Forgery via Webhook
Slug
uncanny-automator
Published
2025-04-03
Title
Uncanny Automator < 6.4.0 - Subscriber+ Privilege Escalation
Slug
uncanny-automator
Published
2025-05-13
Title
Uncanny Automator < 6.4.0.2 - Unauthenticated PHP Object Injection in automator_api_decode_message Function
Slug
uncanny-automator
Published
2025-05-09
Title
Uncanny Automator < 6.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
Slug
uncanny-automator
Published
2025-06-02
Title
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin < 6.5.0 - Missing Authorization
Slug
uncanny-automator
Published
2025-08-27
Title
Uncanny Automator < 6.8.0 - Missing Authorization
Slug
uncanny-automator
Published
2025-11-07
Title
Uncanny Automator < 6.10.0 - Authenticated (Subscriber+) Information Exposure
Slug
uncanny-automator
Published
2026-01-22
Title
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin < 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
uncanny-automator-pro
Published
2024-06-28
Title
Uncanny Automator Pro < 5.3.0.1 - Missing Authorization to Unauthenticated License Setting Reset