WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-dropbox-dropins
Published
2024-10-17
Title
WP Dropbox Dropins <= 1.0 - Unauthenticated Arbitrary File Upload
Slug
wp-dropzone
Published
2025-11-17
Title
WP Dropzone < 1.1.1 - Authenticated (Subscriber+) Arbitrary File Upload
Slug
wp-dropzone
Published
2025-12-11
Title
WP Dropzone < 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'callback' Shortcode Attribute
Slug
wp-ds-blog-map
Published
2022-07-18
Title
WP DS Blog Map <= 3.1.3 - Admin+ Stored Cross-Site Scripting
Slug
wp-ds-faq
Published
2014-08-01
Title
WP DS FAQ <= 1.3.2 - ajax.php id Parameter SQL Injection
Slug
wp-ds-faq-plus
Published
2014-08-01
Title
WP DS FAQ Plus 1.0.3 - Multiple Unspecified CSRF
Slug
wp-ds-faq-plus
Published
2014-08-01
Title
WP DS FAQ Plus - Unspecified SQL Injection
Slug
wp-ds-faq-plus
Published
2020-01-24
Title
WP DS FAQ Plus < 1.4.2 - Stored Cross-Site Scripting (XSS)
Slug
wp-dtree-30
Published
2023-04-19
Title
WP-dTree <= 4.4.5 - Admin+ Stored XSS
Slug
wp-dtree-30
Published
2023-09-01
Title
WP-dTree <= 4.4.5 - Reflected XSS
Slug
wp-dtree-30
Published
2023-09-04
Title
WP-dTree <= 4.4.5 - Settings Update via CSRF
Slug
wp-dummy-content-generator
Published
2023-07-07
Title
WP Dummy Content Generator < 3.0.0 - Cross-Site Request Forgery
Slug
wp-dummy-content-generator
Published
2024-02-02
Title
WP Dummy Content Generator < 3.1.3 - Missing Authorization
Slug
wp-dummy-content-generator
Published
2024-04-16
Title
WP Dummy Content Generator < 3.3.0 - Unauthenticated Code Injection
Slug
wp-dummy-content-generator
Published
2025-06-16
Title
WP Dummy Content Generator < 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion
Slug
wp-duplicate-page
Published
2022-06-20
Title
WP Duplicate Page < 1.3 - Admin+ Stored Cross Site Scripting
Slug
wp-duplicate-page
Published
2025-11-17
Title
WP Duplicate Page < 1.8 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure
Slug
wp-duplicate-page
Published
2026-01-12
Title
WP Duplicate Page < 1.8.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication
Slug
wp-dynamic-keywords-injector
Published
2023-02-20
Title
WP Dynamic Keywords Injector < 2.3.16 - Settings Update via CSRF
Slug
wp-dynamic-keywords-injector
Published
2024-04-15
Title
WP Dynamic Keywords Injector < 2.3.22 - Reflected Cross-Site Scripting
Slug
wp-dynamic-links
Published
2025-08-12
Title
WP Dynamic Links <= 1.0.1 - Reflected Cross-Site Scripting
Slug
wp-e-commerce
Published
2015-02-09
Title
WP eCommerce 3.8.9.5 - Cross-Site Scripting (XSS)
Slug
wp-e-commerce
Published
2014-08-01
Title
WP eCommerce 3.8.9 - Cross-Site Scripting (XSS)
Slug
wp-e-commerce
Published
2014-08-01
Title
WP eCommerce 3.8.9 - SQL Injection
Slug
wp-e-commerce
Published
2014-08-01
Title
WP eCommerce 3.8.6 - Cross-Site Scripting (XSS)