WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-js-external-link-info
Published
2014-08-01
Title
JS External Link Info 1.21 - redirect.php blog Parameter XSS
Slug
wp-js-impress
Published
2024-11-04
Title
imPress <= 0.1.4 - Reflected Cross-Site Scripting
Slug
wp-js-list-pages-shortcodes
Published
2026-01-06
Title
WP Js List Pages Shortcodes <= 1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute
Slug
wp-jscrollpane
Published
2025-08-07
Title
WP-jScrollPane <= 2.0.3 - Reflected Cross-Site Scripting
Slug
wp-jump-menu
Published
2023-10-02
Title
WP Jump Menu <= 3.6.4 - Admin+ Stored XSS
Slug
wp-keybase-verification
Published
2026-02-17
Title
Keybase.io Verification < 1.4.6 - Cross-Site Request Forgery to Settings Update
Slug
wp-keyword-monitor
Published
2025-02-03
Title
WP Keyword Monitor <= 1.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
wp-knowledgebase
Published
2023-10-26
Title
WP Knowledgebase <= 1.3.4 - CSRF
Slug
wp-krpano
Published
2025-01-16
Title
WP krpano <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-landing-page
Published
2025-12-05
Title
WP Landing Page <= 0.9.3 - Cross-Site Request Forgery to Arbitrary Post Meta Update
Slug
wp-last-modified
Published
2025-03-11
Title
WP Last Modified <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
wp-last-modified-info
Published
2020-04-03
Title
WP Last Modified Info < 1.6.6 - Authenticated Stored XSS
Slug
wp-last-modified-info
Published
2024-08-19
Title
WP Last Modified Info < 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via lmt-post-modified-info Shortcode
Slug
wp-last-modified-info
Published
2025-10-18
Title
WP Last Modified Info < 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-last-modified-info
Published
2025-08-24
Title
WP Last Modified Info < 1.9.5 - Authenticated (Contributor+) Remote Code Execution
Slug
wp-last-modified-info
Published
2026-02-13
Title
WP Last Modified Info < 1.9.6 - Insecure Direct Object Reference to Authenticated (Author+) Post Metadata Modification
Slug
wp-latest-posts
Published
2015-08-15
Title
WP Latest Posts < 3.7.5 - XSS
Slug
wp-latest-posts
Published
2024-05-07
Title
WP Latest Posts < 5.0.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
Slug
wp-lead-capture
Published
2026-01-08
Title
Lead Capturing Pages <= 2.5 - Unauthenticated SQL Injection
Slug
wp-lead-capture
Published
2026-01-12
Title
Lead Capturing Pages <= 2.5 - Authenticated (Subscriber+) SQL Injection
Slug
wp-lead-stream
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-lead-stream
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-leads-builder-any-crm
Published
2025-03-27
Title
Lead Form Data Collection to CRM < 3.1 - Authenticated (Contributor+) SQL Injection
Slug
wp-leads-builder-any-crm
Published
2025-05-09
Title
Lead Form Data Collection to CRM < 3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
Slug
wp-leads-builder-any-crm
Published
2025-07-01
Title
Lead Form Data Collection to CRM < 3.2 - Missing Authorization to Authenticated (Subscriber+) Many Actions