WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-post-to-pdf
Published
2014-08-01
Title
WP Post to PDF 2.3.1 - wp-admin/options.php wpptopdf headerFontSize Parameter XSS
Slug
wp-post-to-pdf-enhanced
Published
2025-04-17
Title
WP Post to PDF Enhanced <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
wp-postratings
Published
2011-10-06
Title
WP Postratings < 1.62 - Authenticated SQL Injection
Slug
wp-postratings
Published
2020-12-24
Title
WP Postratings < 1.86.1 - Admin+ Stored Cross-Site Scripting
Slug
wp-postratings
Published
2022-08-31
Title
WP-PostRatings < 1.90 - Ratings Tempering via Race Condition
Slug
wp-postratings
Published
2024-08-01
Title
WP-PostRatings < 1.91.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-postratings-cheater
Published
2025-02-24
Title
WP-PostRatings Cheater <= 1.5 - Cross-Site Request Forgery
Slug
wp-posts-carousel
Published
2025-03-01
Title
WP Posts Carousel < 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_play_timeout Parameter
Slug
wp-posts-carousel
Published
2025-03-28
Title
WP Posts Carousel < 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-posts-carousel
Published
2025-03-27
Title
WP Posts Carousel < 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-posts-carousel
Published
2025-04-16
Title
WP Posts Carousel < 1.3.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-posts-carousel
Published
2025-05-29
Title
WP Posts Carousel < 1.3.13 - Authenticated (Contributor+) PHP Object Injection
Slug
wp-posturl
Published
2022-06-01
Title
Add Post URL <= 2.1.0 - Arbitrary Settings Update to Stored XSS via CSRF
Slug
wp-postviews
Published
2014-08-01
Title
WP-PostViews 1.62 - Setting Manipulation CSRF
Slug
wp-power-stats
Published
2023-10-03
Title
WP Power Stats <= 2.2.3 - CSRF
Slug
wp-powerplaygallery
Published
2014-08-01
Title
wp-powerplaygallery - Arbitrary File Upload
Slug
wp-powerplaygallery
Published
2014-08-01
Title
SWFUpload - Cross-Site Scripting (XSS)
Slug
wp-powerplaygallery
Published
2015-07-01
Title
Powerplay Gallery - Arbitrary File Upload & SQL Injection
Slug
wp-prayer
Published
2021-06-30
Title
WP Prayer < 1.5.5 - Unauthorised AJAX call via CSRF
Slug
wp-prayer
Published
2021-05-17
Title
WP Prayer < 1.6.2 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
wp-prayer
Published
2021-06-08
Title
WP Prayer < 1.6.7 - Arbitrary Plugin Settings Update via CSRF
Slug
wp-prayer
Published
2023-02-14
Title
WP Prayer < 1.9.7 - Admin+ Stored XSS
Slug
wp-prayer
Published
2021-06-08
Title
WP Prayer < 1.6.6 - Cross-Site Request Forgery
Slug
wp-prayer
Published
2024-04-24
Title
WP Prayer <= 2.0.9 - Arbitrary Prayer Deletion via CSRF
Slug
wp-prayer
Published
2024-04-24
Title
WP Prayer <= 2.0.9 - Settings Update via CSRF