WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
use-your-drive
Published
2021-12-13
Title
Use Your Drive < 1.18.3 - Reflected Cross-Site Scripting
Slug
use-your-drive
Published
2025-08-04
Title
Use-your-Drive | Google Drive plugin for WordPress < 3.3.2- Unauthenticated Stored Cross-Site Scripting via File Metadata
Slug
use-your-drive
Published
2026-09-17
Title
WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box <= 3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload via Media Import
Slug
useful-banner-manager
Published
2022-05-17
Title
Useful Banner Manager <= 1.6.1 - Modify banners via CSRF
Slug
useful-tab-block-responsive-amp-compatible
Published
2025-07-17
Title
Useful Tab Block – Responsive & AMP-Compatible <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter
Slug
useinfluence
Published
2025-03-31
Title
Useinfluence <= 1.0.8 - Cross-Site Request Forgery
Slug
user-access-manager
Published
2017-05-11
Title
User Access Manager <= 2.0.8 - Authenticated Reflected Cross-Site Scripting (XSS)
Slug
user-access-manager
Published
2011-06-19
Title
User Access Manager < 1.2 - CSRF
Slug
user-access-manager
Published
2023-08-04
Title
User Access Manager < 2.2.18 - IP Spoofing
Slug
user-access-manager
Published
2026-08-01
Title
User Access Manager < 2.3.16 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter
Slug
user-access-manager
Published
2026-08-04
Title
User Access Manager < 2.3.13 - Authenticated (Subscriber+) SQL Injection
Slug
user-access-manager
Published
2026-08-10
Title
User Access Manager < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST API
Slug
user-access-manager
Published
2026-09-08
Title
User Access Manager < 2.3.19 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter
Slug
user-activation-email
Published
2021-09-08
Title
User Activation Email <= 1.3.0 - Reflected Cross-Site Scripting
Slug
user-activity
Published
2023-02-03
Title
User Activity <= 1.0.1 - IP Spoofing
Slug
user-activity-log
Published
2021-08-30
Title
User Activity Log < 1.4.7 - Reflected Cross Site Scripting via Query String
Slug
user-activity-log
Published
2021-08-30
Title
User Activity Log < 1.4.7 - Reflected Cross-Site Scripting
Slug
user-activity-log
Published
2023-07-03
Title
User Activity Log < 1.6.3 - Admin+ SQL Injection
Slug
user-activity-log
Published
2023-07-24
Title
User Activity Log < 1.6.5 - Unauthenticated SQLi
Slug
user-activity-log
Published
2023-08-09
Title
User Activity Log < 1.6.6 - Subscriber+ Log Export
Slug
user-activity-log
Published
2023-08-14
Title
User Activity Log < 1.6.7 - IP Spoofing
Slug
user-activity-log
Published
2023-07-12
Title
User Activity Log < 1.6.3 - Admin+ SQLi
Slug
user-activity-log
Published
2024-04-07
Title
User Activity Log < 2.0 - Admin+ SQL Injection
Slug
user-activity-log
Published
2026-01-06
Title
User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update
Slug
user-activity-log
Published
2026-01-06
Title
User Activity Log <= 2.2 - Unauthenticated Limited Options Update via Failed Login