WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-client-reports
Published
2024-04-12
Title
WP Client Reports < 1.0.23 - Cross-Site Request Forgery
Slug
wp-client-testimonial
Published
2026-01-08
Title
Client Testimonial Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aft_testimonial_meta_name' Metabox Field
Slug
wp-client-testimonial
Published
2026-02-18
Title
Client Testimonial Slider <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Testimonial Heading' Setting
Slug
wp-clippy
Published
2026-05-04
Title
WP-Clippy <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
wp-clone-any-post-type
Published
2025-04-01
Title
WP Clone any post type <= 3.5 - Open Redirect
Slug
wp-clone-any-post-type
Published
2025-04-01
Title
WP Clone any post type <= 3.6 - Missing Authorization
Slug
wp-clone-by-wp-academy
Published
2014-08-01
Title
WP Clone by WP Academy <= 2.1.1 - XSS in ZeroClipboard
Slug
wp-clone-by-wp-academy
Published
2023-07-27
Title
Multiple Plugins from Inisev - Subscriber+ Plugin Installation
Slug
wp-clone-by-wp-academy
Published
2023-07-27
Title
Multiple Plugins from Inisev - Plugin Installation via CSRF
Slug
wp-clone-by-wp-academy
Published
2023-12-18
Title
Clone < 2.4.3 - Unauthenticated Backup Download
Slug
wp-clone-by-wp-academy
Published
2024-04-10
Title
Clone < 2.4.4 - Subscriber+ Unauthorised Action Calls
Slug
wp-clone-by-wp-academy
Published
2024-08-16
Title
Clone < 2.4.6 - Missing Authorization
Slug
wp-clone-by-wp-academy
Published
2024-11-19
Title
Clone < 2.4.7 - Unauthenticated PHP Object Injection via 'recursive_unserialized_replace'
Slug
wp-cloud-server
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-cloudflare-page-cache
Published
2024-03-13
Title
Super Page Cache for Cloudflare < 4.7.6 - Cross-Site Request Forgery
Slug
wp-cloudflare-page-cache
Published
2026-02-13
Title
Super Page Cache < 5.2.3 - Unauthenticated Stored Cross-Site Scripting via Activity Log
Slug
wp-cloudy
Published
2021-10-13
Title
WP Cloudy < 4.4.9 - Admin+ SQL Injection
Slug
wp-club-manager
Published
2024-02-05
Title
WP Club Manager – WordPress Sports Club Plugin < 2.2.11 - Missing Authorization to Unauthenticated Event Permalink Update
Slug
wp-club-manager
Published
2024-04-16
Title
WP Club Manager < 2.2.12 - Authenticated (Player+) Stored Cross-Site Scripting
Slug
wp-club-manager
Published
2024-04-22
Title
WP Club Manager < 2.2.12 - Missing Authorization
Slug
wp-code-highlightjs
Published
2019-07-17
Title
WP Code Highlight.js < 0.6.3 - CSRF to Stored XSS
Slug
wp-code-highlightjs
Published
2019-10-29
Title
WP Code Highlight.js <= 0.6.3 - Undisclosed Cross-Site Scripting (XSS)
Slug
wp-codemirror-block
Published
2024-02-27
Title
CodeMirror Blocks < 2.0.0 - Contributor+ Stored XSS
Slug
wp-coder
Published
2021-12-05
Title
WP Coder < 2.5.2 - RFI leading to RCE via CSRF
Slug
wp-coder
Published
2022-07-26
Title
WP Coder < 2.5.3 - Code Deletion via CSRF