WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
usc-e-shop
Published
2025-09-09
Title
Welcart e-Commerce < 2.11.21 - Authenticated (Editor+) Stored Cross-Site Scripting
Slug
usc-e-shop
Published
2025-09-09
Title
Welcart e-Commerce < 2.11.21 - Authenticated (Editor+) Stored Cross-Site Scripting
Slug
usc-e-shop
Published
2025-10-07
Title
Welcart e-Commerce < 2.11.22 - Authenticated (Author+) SQL Injection via Cookie
Slug
usc-e-shop
Published
2025-10-21
Title
Welcart e-Commerce < 2.11.23 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail
Slug
usc-e-shop
Published
2025-10-14
Title
Welcart e-Commerce < 2.11.25 - Missing Authorization
Slug
usc-e-shop
Published
2025-11-12
Title
Welcart e-Commerce < 2.11.25 - Missing Authorization to Unauthenticated Information Exposure
Slug
usc-e-shop
Published
2026-06-04
Title
Welcart e-Commerce < 2.11.29 - Missing Authorization
Slug
use-any-font
Published
2022-01-31
Title
Use Any Font < 6.2.1 - Unauthenticated Arbitrary CSS Appending
Slug
use-any-font
Published
2022-03-30
Title
Use Any Font < 6.2.1 - API Key Deactivation via CSRF
Slug
use-any-font
Published
2024-09-25
Title
Use Any Font < 6.3.09 - Cross-Site Request Forgery
Slug
use-memcached
Published
2023-09-04
Title
Use Memcached <= 1.0.5 - Settings Update via CSRF
Slug
use-your-drive
Published
2021-12-13
Title
Use Your Drive < 1.18.3 - Reflected Cross-Site Scripting
Slug
use-your-drive
Published
2025-08-04
Title
Use-your-Drive | Google Drive plugin for WordPress < 3.3.2- Unauthenticated Stored Cross-Site Scripting via File Metadata
Slug
useful-banner-manager
Published
2022-05-17
Title
Useful Banner Manager <= 1.6.1 - Modify banners via CSRF
Slug
useful-tab-block-responsive-amp-compatible
Published
2025-07-17
Title
Useful Tab Block – Responsive & AMP-Compatible <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter
Slug
useinfluence
Published
2025-03-31
Title
Useinfluence <= 1.0.8 - Cross-Site Request Forgery
Slug
user-access-manager
Published
2017-05-11
Title
User Access Manager <= 2.0.8 - Authenticated Reflected Cross-Site Scripting (XSS)
Slug
user-access-manager
Published
2011-06-19
Title
User Access Manager < 1.2 - CSRF
Slug
user-access-manager
Published
2023-08-04
Title
User Access Manager < 2.2.18 - IP Spoofing
Slug
user-activation-email
Published
2021-09-08
Title
User Activation Email <= 1.3.0 - Reflected Cross-Site Scripting
Slug
user-activity
Published
2023-02-03
Title
User Activity <= 1.0.1 - IP Spoofing
Slug
user-activity-log
Published
2021-08-30
Title
User Activity Log < 1.4.7 - Reflected Cross Site Scripting via Query String
Slug
user-activity-log
Published
2021-08-30
Title
User Activity Log < 1.4.7 - Reflected Cross-Site Scripting
Slug
user-activity-log
Published
2023-07-03
Title
User Activity Log < 1.6.3 - Admin+ SQL Injection
Slug
user-activity-log
Published
2023-07-24
Title
User Activity Log < 1.6.5 - Unauthenticated SQLi