WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-emoji-one
Published
2023-07-19
Title
WP Emoji One <= 0.6.0 - Settings Update via CSRF
Slug
wp-emoticon-rating
Published
2026-06-08
Title
WP Emoticon Rating <= 1.0.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting via 'emo_settings' Parameter
Slug
wp-employee-attendance-system
Published
2025-06-12
Title
WP Employee Attendance System <= 3.5 - Authenticated (Administrator+) SQL Injection
Slug
wp-enable-svg
Published
2024-12-11
Title
WP Enabled SVG <= 0.2 - Author+ Stored XSS via SVG
Slug
wp-enable-webp
Published
2026-01-06
Title
WP Enable WebP <= 1.0 - Authenticated (Author+) Arbitrary File Upload
Slug
wp-estimation-form
Published
2024-03-28
Title
WP Cost Estimation & Payment Forms Builder < 10.1.76 - Authenticated (Contributor+) SQL Injection
Slug
wp-estimation-form
Published
2024-04-15
Title
WP Cost Estimation & Payment Forms Builder < 10.1.77 - Missing Authorization
Slug
wp-estimation-form
Published
2024-04-15
Title
WP Cost Estimation & Payment Forms Builder < 10.1.76 - Reflected Cross-Site Scripting
Slug
wp-estimation-form
Published
2026-07-08
Title
WP Cost Estimation & Payment Forms Builder (E&P Forms) <= 10.5.97 - Unauthenticated Stored Cross-Site Scripting via 'customerInfos' Parameter
Slug
wp-etracker
Published
2024-05-06
Title
WP etracker <= 1.0.2 - Reflected Cross-Site Scripting
Slug
wp-event-aggregator
Published
2024-04-09
Title
WP Event Aggregator < 1.7.7 - Cross-Site Request Forgery via wpea_deauthorize_user()
Slug
wp-event-aggregator
Published
2024-07-11
Title
WP Event Aggregator < 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-event-aggregator
Published
2025-02-01
Title
WP Event Aggregator < 1.8.3 - Reflected Cross-Site Scripting
Slug
wp-event-aggregator
Published
2026-02-17
Title
WP Event Aggregator < 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
wp-event-manager
Published
2022-02-14
Title
WP Event Manager < 3.1.23 - Admin+ Stored Cross-Site Scripting
Slug
wp-event-manager
Published
2022-06-20
Title
WP Event Manager < 3.1.28 - Reflected Cross-Site Scripting
Slug
wp-event-manager
Published
2023-09-20
Title
WP Event Manager < 3.1.38 - Admin+ Stored XSS
Slug
wp-event-manager
Published
2023-11-09
Title
WP Event Manager < 3.1.43 - Reflected XSS
Slug
wp-event-manager
Published
2023-11-29
Title
WP Event Manager < 3.1.42 - Editor+ Stored XSS
Slug
wp-event-manager
Published
2024-02-23
Title
WP Event Manager < 3.1.42 - Reflected Cross-Site Scripting via plugin
Slug
wp-event-manager
Published
2024-07-15
Title
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce < 3.1.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events' Shortcode
Slug
wp-event-manager
Published
2025-04-04
Title
WP Event Manager < 3.2.1 - Missing Authorization
Slug
wp-event-manager
Published
2025-05-21
Title
WP Event Manager < 3.2.0 - Unauthenticated Local File Inclusion
Slug
wp-event-manager
Published
2025-07-15
Title
WP Event Manager < 3.1.51 - Unauthenticated Stored Cross-Site Scripting via 'organizer_name'
Slug
wp-event-manager
Published
2025-06-10
Title
WP Event Manager < 3.1.50 - Authenticated (Administrator+) Stored Cross-Site Scripting