WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
webmaster-tools-verification
Published
2022-10-19
Title
Webmaster Tools Verification <= 1.2 - Unauthenticated Arbitrary Plugin Deactivation
Slug
webo-facto-connector
Published
2024-09-17
Title
Webo-facto < 1.41 - Unauthenticated Privilege Escalation
Slug
webp-conversion
Published
2026-01-26
Title
WebP Conversion <= 2.1 - Missing Authorization
Slug
webp-converter-for-media
Published
2019-06-27
Title
WebP Converter for Media <= 1.0.2 - Cross-Site Request Forgery (CSRF)
Slug
webp-converter-for-media
Published
2021-12-27
Title
WebP Converter for Media < 4.0.3 - Unauthenticated Open redirect
Slug
webp-converter-for-media
Published
2025-12-16
Title
Converter for Media < 6.4.0 - Subscriber+ Optimized Image Deletion via regenerate-attachment REST Endpoint
Slug
webp-converter-for-media
Published
2026-02-11
Title
Converter for Media – Optimize images < 6.5.2 - Unauthenticated SSRF
Slug
webp-express
Published
2019-06-16
Title
WebP Express <= 0.14.10 - Multiple Issues
Slug
webp-express
Published
2019-06-26
Title
WebP Express < 0.14.8 - Authenticated Stored XSS
Slug
webp-express
Published
2025-12-03
Title
WebP Express < 0.25.11 - Unauthenticated Information Exposure
Slug
webp-svg-support
Published
2024-06-05
Title
WebP & SVG Support <= 1.4.0 - Author+ Stored XSS via SVG
Slug
webparex
Published
2025-02-21
Title
Shipmozo Courier Tracking <= 1.0 - Reflected Cross-Site Scripting
Slug
webpurifytextreplace
Published
2026-02-03
Title
WebPurify Profanity Filter < 4.0.3 - Missing Authorization to Unauthenticated Plugin Settings Change via webpurify_save_options
Slug
webpushr-web-push-notifications
Published
2023-11-06
Title
Webpushr < 4.35.0 - Unauthenticated Stored XSS
Slug
webpushr-web-push-notifications
Published
2023-10-19
Title
Webpushr < 4.35.0 - LFI via CSRF
Slug
webpushr-web-push-notifications
Published
2024-05-03
Title
Webpushr < 4.36.0 - Reflected Cross-Site Scripting
Slug
webpushr-web-push-notifications
Published
2026-01-25
Title
Webpushr < 4.39.0 - Unauthenticated Information Exposure
Slug
webriti-companion
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
webriti-custom-login-page
Published
2024-11-01
Title
Webriti Custom Login <= 0.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
Slug
webriti-smtp-mail
Published
2022-05-18
Title
Webriti SMTP Mail <= 1.0 - Arbitrary Settings Update via CSRF
Slug
webrotate-360-product-viewer
Published
2015-05-14
Title
Multiple Plugins - jQuery prettyPhoto DOM Cross-Site Scripting (XSS)
Slug
websand-subscription-form
Published
2024-11-08
Title
Websand Subscription Form <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
websimon-tables
Published
2015-11-24
Title
Websimon Tables <= 1.3.4 - Authenticated Reflected Cross-Site Scripting (XSS)
Slug
website-article-monetization-by-magenet
Published
2024-03-19
Title
Website Article Monetization By MageNet < 1.0.12 - Unauthenticated Stored XSS
Slug
website-builder
Published
2025-09-22
Title
Draft <= 3.0.9 - Authenticated (Editor+) Stored Cross-Site Scripting