WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-lucky-wheel
Published
2026-02-10
Title
Lucky Wheel Giveaway < 1.0.23 - Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter
Slug
wp-lytebox
Published
2014-08-01
Title
Lytebox - Local File Inclusion
Slug
wp-magazine-modules-lite
Published
2024-06-18
Title
WP Magazine Modules Lite < 1.1.3 - Authenticated (Contributor+) Local File Inclusion
Slug
wp-magnific-popup
Published
2026-05-27
Title
WP Magnific Popup <= 1.0 - Author+ Stored XSS via href Attribute
Slug
wp-mail
Published
2025-09-05
Title
WP Mail <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-mail
Published
2026-01-16
Title
Mail <= 1.3 - Reflected Cross-Site Scripting
Slug
wp-mail-bank
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-mail-catcher
Published
2023-06-09
Title
WP Mail Catcher < 2.1.3 - Unauthenticated Stored Cross-Site Scripting
Slug
wp-mail-catcher
Published
2023-10-29
Title
Mail logging - WP Mail Catcher < 2.1.4 - Admin+ SQLi
Slug
wp-mail-catcher
Published
2024-04-11
Title
WP Mail Catcher < 2.1.7 - Cross-Site Request Forgery
Slug
wp-mail-catcher
Published
2024-09-27
Title
WP Mail Catcher < 2.1.10 - Reflected Cross-Site Scripting
Slug
wp-mail-gateway
Published
2026-05-01
Title
WP Mail Gateway < 1.8.1 - Missing Authorization to Authenticated (Subscriber+) SMTP Configuration Modification via 'wmg_save_provider_config' AJAX Action
Slug
wp-mail-log
Published
2023-07-05
Title
WP Mail Log < 1.1.2 - Unauthenticated Stored Cross-Site Scripting
Slug
wp-mail-log
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-mail-log
Published
2023-11-28
Title
WP Mail Log < 1.1.3 – Incorrect Authorization in REST API Endpoints
Slug
wp-mail-log
Published
2023-11-28
Title
WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs endpoint
Slug
wp-mail-log
Published
2023-11-28
Title
WP Mail Log < 1.1.3 – Contributor+ Arbitrary File Upload to RCE
Slug
wp-mail-log
Published
2023-11-28
Title
WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs/send_mail endpoint
Slug
wp-mail-log
Published
2023-11-28
Title
WP Mail Log < 1.1.3 – Contributor+ LFI in wml_logs/send_mail endpoint
Slug
wp-mail-log
Published
2023-12-27
Title
WP Mail Log Plugin < 1.1.3 - Contributor+ Arbitrary File Upload
Slug
wp-mail-log
Published
2023-11-20
Title
WP Mail Log < 1.1.3 - Editor+ SQL Injection via id
Slug
wp-mail-logging
Published
2017-11-11
Title
WP Mail Logging <= 1.8.2 - Stored Cross-Site Scripting
Slug
wp-mail-logging
Published
2021-11-29
Title
WP Mail Logging < 1.10.0 - Outdated Redux Framework
Slug
wp-mail-logging
Published
2023-06-08
Title
WP Mail Logging < 1.11.2 - Unauthenticated Stored Cross-Site Scripting
Slug
wp-mail-logging
Published
2026-02-27
Title
WP Mail Logging < 1.16 - Unauthenticated PHP Object Injection via Email Log Message Field