WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-booking-system-premium
Published
2026-07-07
Title
WP Booking System – Booking Calendar Premium < 5.12.8.1 - Missing Authorization
Slug
wp-bookmarks
Published
2025-04-01
Title
WP Bookmarks <= 1.1 - Reflected Cross-Site Scripting
Slug
wp-books-gallery
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-books-gallery
Published
2023-02-20
Title
Books Gallery < 4.4.9 - CSRF
Slug
wp-books-gallery
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-books-gallery
Published
2026-04-23
Title
WP Books Gallery < 4.8.1 - Missing Authorization to Unauthenticated Settings Update via 'permalink_structure' Parameter
Slug
wp-books-gallery
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Slug
wp-bookwidgets
Published
2025-10-14
Title
WP BookWidgets < 0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-bootscraper
Published
2024-11-18
Title
Bootscraper < 4.0.0 - Unauthenticated Local File Inclusion
Slug
wp-bootstrap-tabs
Published
2025-11-10
Title
WP Bootstrap Tabs <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
wp-born-babies
Published
2022-05-16
Title
WP Born Babies <= 1.0 - Contributor+ Stored Cross-Site Scripting
Slug
wp-broken-images
Published
2024-03-29
Title
Broken Images <= 0.2 - Cross-Site Request Forgery
Slug
wp-browser-update
Published
2023-04-24
Title
WP BrowserUpdate < 4.6 - Admin+ Stored XSS
Slug
wp-browser-update
Published
2023-04-24
Title
WP BrowserUpdate < 4.5 - Settings Update via CSRF
Slug
wp-buddha-free-adwords
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-buddha-free-adwords
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
wp-bugbot
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-bugbot
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-bulk-delete
Published
2024-09-30
Title
WP Bulk Delete < 1.3.2 - Reflected Cross-Site Scripting
Slug
wp-bulk-delete
Published
2025-08-27
Title
WP Bulk Delete < 1.3.7 - Missing Authorization
Slug
wp-bulk-delete
Published
2026-07-15
Title
WP Bulk Delete < 1.4.3 - Authenticated (Administrator+) SQL Injection via 'delete_user_roles' Parameter
Slug
wp-bulk-post-duplicator
Published
2025-03-11
Title
WP Bulk Post Duplicator <= 1.2 - Cross-Site Request Forgery
Slug
wp-bulk-sms
Published
2025-01-06
Title
WP – Bulk SMS – by SMS.to <= 1.0.12 - Reflected Cross-Site Scripting
Slug
wp-bulletin-board
Published
2025-01-14
Title
WP Bulletin Board <= 1.1.4 - Reflected Cross-Site Scripting
Slug
wp-business-directory
Published
2015-05-14
Title
Multiple Plugins - jQuery prettyPhoto DOM Cross-Site Scripting (XSS)