WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
uni-woo-custom-product-options-premium
Published
2025-09-22
Title
Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) < 4.9.56 - Unauthenticated Arbitrary File Upload via 'uni_cpo_upload_file'
Slug
uniconsent-cmp
Published
2023-10-02
Title
UniConsent Cookie Consent CMP for GDPR / CCPA < 1.4.4 - Admin+ Stored XSS
Slug
unify
Published
2025-10-02
Title
Unify < 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via unify_checkout Shortcode
Slug
unify
Published
2026-01-06
Title
Unify <= 3.4.9 - Missing Authorization to Unauthenticated Option Deletion via 'unify_plugin_downgrade' Parameter
Slug
unilevel-mlm-plan
Published
2025-01-06
Title
Unilevel MLM Plan < 2.0.0 - Reflected Cross-Site Scripting via 'page'
Slug
uninstall
Published
2015-02-11
Title
WordPress Uninstall <= 1.2.1 - WordPress Deletion via CSRF
Slug
unique-ux
Published
2025-01-16
Title
Unique UX <= 0.9.2 - Reflected Cross-Site Scripting
Slug
unite-gallery-lite
Published
2015-07-25
Title
Unite Gallery Lite < 1.5 - CSRF & Authenticated SQL Injection
Slug
unite-gallery-lite
Published
2023-05-22
Title
Unite Gallery Lite < 1.7.60 - Admin+ Local File Inclusion
Slug
unite-gallery-lite
Published
2023-05-30
Title
Unite Gallery Lite < 1.7.62 - Admin+ Stored XSS
Slug
unite-gallery-lite
Published
2024-08-09
Title
Unite Gallery Lite <= 1.7.62 - Authenticated (Contributor+) SQL Injection
Slug
unitimetable
Published
2025-02-02
Title
UniTimetable <= 1.1 - Unauthenticated Stored Cross-Site Scripting
Slug
universal-analytics
Published
2016-02-04
Title
Universal Analytics <= 1.3.0 - Authenticated Cross-Site Scripting (XSS)
Slug
universal-analytics-injector
Published
2025-01-16
Title
Universal Analytics Injector <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
universal-email-preference-center
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
universal-star-rating
Published
2022-01-13
Title
Universal Star Rating <= 2.1.0 - CSRF
Slug
universal-video-player
Published
2025-12-31
Title
Universal Video Player <= 3.8.4 - Reflected Cross-Site Scripting
Slug
universal-video-player
Published
2025-12-30
Title
Universal Video Player <= 3.8.4 - Reflected Cross-Site Scripting
Slug
universal-video-player-and-bg
Published
2025-05-16
Title
Video Player & FullScreen Video Background <= 2.4.1 - Authenticated (Administrator+) SQL Injection
Slug
universal_video_player
Published
2025-06-05
Title
Universal Video Player <= 3.8.3 - Reflected Cross-Site Scripting
Slug
universam-demo
Published
2024-12-11
Title
UNIVERSAM < 8.59 - Reflected Cross-Site Scripting
Slug
universam-demo
Published
2025-07-06
Title
UNIVERSAM <= 8.72.34 - Unauthenticated PHP Object Injection
Slug
university-quizzes-online
Published
2025-01-16
Title
University quizzes online <= 1.4 - Reflected Cross-Site Scripting
Slug
unlimited-addon-for-elementor
Published
2024-10-14
Title
Unlimited Addon For Elementor <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
unlimited-addons-for-wpbakery-page-builder
Published
2024-01-17
Title
Unlimited Addons for WPBakery Page Builder <= 1.0.42 - Authenticated (Editor+) Arbitrary File Upload