WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-sheet-editor-edd-downloads
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-sheet-editor-edd-downloads
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-shieldon
Published
2021-01-18
Title
WP Shieldon < 1.6.4 - Unauthenticated Cross-Site Scripting (XSS)
Slug
wp-shop-original
Published
2015-09-17
Title
WP Shop <= 3.4.3.18 - Cross-Site Scripting (XSS) & CSRF
Slug
wp-shop-original
Published
2015-07-08
Title
WP Shop <= 3.4.3.15 - Unauthenticated Blind SQL Injection
Slug
wp-shop-original
Published
2022-08-31
Title
WP Shop Original <= 3.9.6 - Unauthenticated Settings Update
Slug
wp-shopify
Published
2025-06-05
Title
WP Shopify <= 1.5.9 - Contributor+ Local File Inclusion
Slug
wp-shopify
Published
2025-07-24
Title
WP Shopify < 1.5.4 - Reflected XSS
Slug
wp-shopping-cart
Published
2014-08-01
Title
e-Commerce <= 3.4 - Arbitrary File Upload Exploit
Slug
wp-shortcm
Published
2025-09-05
Title
short.io <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-shortcode
Published
2023-03-16
Title
WP Shortcode by MyThemeShop < 1.4.17 - CSRF
Slug
wp-shoutbox-live-chat
Published
2023-04-03
Title
Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated Stored XSS
Slug
wp-shoutbox-live-chat
Published
2023-04-03
Title
Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated SQLi
Slug
wp-show-login-form
Published
2025-03-11
Title
wordpress login form to anywhere <= 0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
wp-show-more
Published
2024-10-25
Title
WP show more <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_more Shortcode
Slug
wp-show-posts
Published
2023-01-11
Title
WP Show Posts < 1.1.4 - Contributor+ Stored XSS
Slug
wp-show-posts
Published
2024-03-01
Title
WP Show Posts < 1.1.5 - Information Exposure
Slug
wp-show-posts
Published
2024-04-16
Title
WP Show Posts < 1.1.6 - Improper Authorization to Information Exposure
Slug
wp-show-stats
Published
2025-04-09
Title
WP Show Stats <= 1.5 - Cross-Site Request Forgery
Slug
wp-showhide
Published
2023-01-10
Title
WP-ShowHide < 1.05 - Contributor+ Stored XSS via Shortcode
Slug
wp-showhide
Published
2025-12-15
Title
WP-ShowHide < 1.06 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-sifr
Published
2025-11-29
Title
sIFR <= 0.6.8.1 - Cross-Site Request Forgery
Slug
wp-signals
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-simple-anchors-links
Published
2024-10-30
Title
WP Simple Anchors Links <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpanchor Shortcode
Slug
wp-simple-booking-calendar
Published
2021-08-06
Title
WP Simple Booking Calendar <= 2.0.6 (before 07/12/2021) - Authenticated SQL Injection