WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
weather-layer
Published
2025-03-24
Title
Weather Layer <= 4.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
weaver-for-bbpress
Published
2025-01-03
Title
Turnkey bbPress by WeaverTheme < 1.7.1 - Reflected Cross-Site Scripting via _wpnonce Parameter
Slug
weaver-themes-shortcode-compatibility
Published
2025-01-18
Title
Weaver Themes Shortcode Compatibility <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
weaverx-theme-support
Published
2023-03-29
Title
Weaver Xtreme Theme Support < 6.2.7 - Contributor+ Stored XSS
Slug
weaverx-theme-support
Published
2023-09-19
Title
Weaver Xtreme Theme Support < 6.3.1 - Admin+ PHP Object Injection
Slug
weaverx-theme-support
Published
2024-06-04
Title
Weaver Xtreme Theme Support < 6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via div Shortcode
Slug
web-application-firewall
Published
2024-03-13
Title
Malware Scanner < 4.7.3 and Web Application Firewall < 2.1.2 - Unauthenticated Privilege Escalation
Slug
web-application-firewall
Published
2024-08-30
Title
Web Application Firewall < 2.1.3 - IP Address Spoofing to Protection Mechanism Bypass
Slug
web-cam
Published
2025-06-25
Title
web-cam < 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug Parameter
Slug
web-directory-free
Published
2024-05-23
Title
Web Directory Free < 1.7.0 - Unauthenticated SQL Injection
Slug
web-directory-free
Published
2024-07-09
Title
Web Directory Free < 1.7.2 - Reflected XSS
Slug
web-directory-free
Published
2024-08-09
Title
Web Directory Free < 1.7.3 - Unauthenticated LFI
Slug
web-directory-free
Published
2024-09-30
Title
Web Directory Free < 1.7.4 - Reflected Cross-Site Scripting
Slug
web-directory-free
Published
2025-03-24
Title
Web Directory Free < 1.7.7 - Unauthenticated SQL Injection
Slug
web-directory-free
Published
2025-04-02
Title
Web Directory Free < 1.7.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
web-directory-free
Published
2025-04-17
Title
Web Directory Free < 1.7.9 - Reflected Cross-Site Scripting
Slug
web-directory-free
Published
2025-12-28
Title
Web Directory Free < 1.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
web-disrupt-funnelmentals
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
web-disrupt-funnelmentals
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
web-disrupt-funnelmentals
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
web-instant-messenger
Published
2020-10-12
Title
LocalWeb All In One plugin < 1.6.5 - Unauthenticated Stored Cross-Site Scripting (XSS)
Slug
web-invoice
Published
2022-12-12
Title
Web Invoice <= 2.1.3 - Authenticated SQLi
Slug
web-invoice
Published
2022-12-12
Title
Web Invoice <= 2.1.3 - Authenticated SQLi
Slug
web-portal-lite-client-portal-secure-file-sharing-private-messaging
Published
2020-03-24
Title
Multiple plugins - Unauthenticated Dompdf Local File Inclusion (LFI)
Slug
web-push
Published
2025-01-16
Title
Web Push <= 1.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting