WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-hashtags
Published
2025-03-11
Title
Hashtags <= 0.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
wp-header-images
Published
2021-10-11
Title
WP Header Images < 2.0.1 - Reflected Cross-Site Scripting
Slug
wp-header-notification
Published
2025-01-07
Title
WP Header Notification <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
wp-headers-and-footers
Published
2025-04-18
Title
WP Headers And Footers < 3.1.2 - Arbitrary Options Update via CSRF
Slug
wp-headmaster
Published
2025-01-14
Title
WP Headmaster <= 0.3 - Reflected Cross-Site Scripting
Slug
wp-health
Published
2024-12-07
Title
WP Umbrella: Update Backup Restore & Monitoring < 2.17.1 - Unauthenticated Local File Inclusion
Slug
wp-hello-bar
Published
2026-01-19
Title
WP Hello Bar <= 1.02 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'digit_one' and 'digit_two' Parameters
Slug
wp-helpdesk-integration
Published
2025-09-04
Title
WordPress Helpdesk Integration <= 5.8.10 - Unauthenticated Local File Inclusion
Slug
wp-helper-lite
Published
2023-01-23
Title
WP Helper Lite < 4.3 - Reflected Cross-Site Scripting
Slug
wp-helper-lite
Published
2023-10-24
Title
WP Helper Premium < 4.5.2 - Cross-Site Request Forgery via whp_fields
Slug
wp-helper-lite
Published
2024-04-16
Title
WP Helper Premium < 4.6.0 - Reflected Cross-Site Scripting
Slug
wp-helper-lite
Published
2024-10-09
Title
WP Helper Premium < 4.6.2 - Missing Authorization in whp_smtp_send_mail_test
Slug
wp-heyloyalty
Published
2017-08-26
Title
Multiple Plugins - Unauthenticated RCE via PHPUnit
Slug
wp-hide
Published
2022-10-17
Title
WP Hide <= 0.0.2 - Unauthenticated Settings Update
Slug
wp-hide-admin-bar
Published
2025-03-11
Title
WP Hide Admin Bar <= 2.0 - Cross-Site Request Forgery
Slug
wp-hide-backed-notices
Published
2024-04-26
Title
Hide Dashboard Notifications < 1.3 - Cross-Site Request Forgery
Slug
wp-hide-backed-notices
Published
2024-06-20
Title
Hide Dashboard Notifications < 1.3.1 - Missing Authorization to Authenticated(Contributor+) Plugin Settings Modification
Slug
wp-hide-categories
Published
2025-04-09
Title
WP Hide Categories <= 1.0 - Reflected Cross-Site Scripting
Slug
wp-hide-pages
Published
2023-09-29
Title
WP Hide Pages <= 1.0 - Settings Update via CSRF
Slug
wp-hide-post
Published
2023-06-03
Title
WP Hide Post <= 2.0.10 - Arbitrary Post Hiding via CSRF
Slug
wp-hide-security-enhancer
Published
2017-07-21
Title
WP Hide & Security Enhancer < 1.4 - Arbitrary File Download
Slug
wp-hide-security-enhancer
Published
2022-08-08
Title
WP Hide & Security Enhancer < 1.8 - Reflected Cross-Site Scripting
Slug
wp-hide-security-enhancer
Published
2024-12-05
Title
WP Hide & Security Enhancer < 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Contents Deletion
Slug
wp-hide-that
Published
2024-12-12
Title
WP-HideThat <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
wp-hijri
Published
2023-05-22
Title
WP-Hijri < 1.5.2 - Reflected XSS