WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
upload-am-file-hosting-vpn
Published
2025-09-29
Title
Upload.am File Hosting VPN < 1.0.1 - Contributor+ Arbitrary Option Disclosure
Slug
upload-fields-for-wpforms
Published
2024-06-03
Title
Upload Fields for WPForms <= 1.0.2 - Missing Authorization
Slug
upload-file-type-settings-plugin
Published
2023-02-15
Title
Upload File Type Settings <= 1.1 - Admin+ Stored XSS
Slug
upload-media-by-url
Published
2023-08-02
Title
Upload Media By URL < 1.0.8 - Stored XSS via CSRF
Slug
upload-quota-per-user
Published
2025-03-24
Title
Upload Quota per User <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
upload-scanner
Published
2024-12-17
Title
Upload Scanner <= 1.2 - Reflected Cross-Site Scripting
Slug
uploadcare
Published
2024-05-30
Title
Uploadcare File Uploader and Adaptive Delivery (beta) < 3.1.0 - Cross-Site Request Forgery
Slug
uploader
Published
2014-08-01
Title
Uploader 1.0.4 - Shell Upload
Slug
uploader
Published
2014-08-01
Title
Uploader 1.0.4 - notify.php blog Parameter XSS
Slug
uploader
Published
2014-08-01
Title
Uploader 1.0.0 - wp-content/plugins/uploader/views/notify.php num Parameter XSS
Slug
uploadify
Published
2011-02-21
Title
Uploadify 1.0 - Unauthenticated Arbitrary File Upload
Slug
uploadify-integration
Published
2014-08-01
Title
Uploadify Integration 0.9.6 - Multiple Cross Site Scripting Vulnerabilities
Slug
uploading-svgwebp-and-ico-files
Published
2022-08-11
Title
Uploading SVG, WEBP and ICO files <= 1.2.1 - Author+ Stored Cross-Site Scripting
Slug
uploading-svgwebp-and-ico-files
Published
2022-08-11
Title
Uploading SVG, WEBP and ICO files <= 1.2.1 - Admin+ Arbitrary File Upload
Slug
uploading-svgwebp-and-ico-files
Published
2023-11-13
Title
Uploading SVG, WEBP and ICO files <= 1.2.1 - Author+ Stored XSS via SVG
Slug
upm-polls
Published
2014-08-01
Title
UPM-POLLS 1.0.4 - BLIND SQL injection
Slug
upmenu
Published
2026-02-13
Title
UpMenu < 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'upmenu-menu' Shortcode 'lang' Attribute
Slug
upqode-google-maps
Published
2023-02-13
Title
UpQode Google Maps <= 1.0.5 - Contributor+ Stored XSS
Slug
upsell-order-bump-offer-for-woocommerce
Published
2025-04-24
Title
Upsell Funnel Builder for WooCommerce < 3.0.1 - Unauthenticated Order Manipulation
Slug
upsell-order-bump-offer-for-woocommerce
Published
2025-09-22
Title
Upsell Order Bump Offer for WooCommerce < 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
upsell-order-bump-offer-for-woocommerce
Published
2026-06-04
Title
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. < 3.1.5 - Missing Authorization
Slug
upsell-order-bump-offer-for-woocommerce
Published
2026-09-01
Title
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. < 3.1.6 - Unauthenticated Stored Cross-Site Scripting
Slug
upsell-order-bump-offer-for-woocommerce
Published
2026-10-27
Title
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. <= 3.1.7 - Reflected Cross-Site Scripting
Slug
upstream
Published
2025-06-19
Title
UpStream: a Project Management Plugin for WordPress <= 2.1.0 - Missing Authorization
Slug
uptime-robot
Published
2025-01-07
Title
Uptime Robot <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting