WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-statistics
Published
2025-09-26
Title
WP Statistics < 14.15.5 - Unauthenticated Stored XSS via User-Agent Header
Slug
wp-statistics
Published
2026-04-16
Title
WP Statistics < 14.16.5 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter
Slug
wp-statistics
Published
2026-04-16
Title
WP Statistics < 14.16.5 - Subscriber+ Sensitive Information Exposure and Privacy Audit Manipulation
Slug
wp-stats
Published
2015-06-17
Title
WP-Stats < 2.52 - CSRF to Stored Cross-Site Scripting (XSS)
Slug
wp-stats-dashboard
Published
2015-11-24
Title
WP-Stats-Dashboard <= 2.9.4 - Authenticated Blind SQL Injection
Slug
wp-stats-manager
Published
2021-11-22
Title
WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection
Slug
wp-stats-manager
Published
2022-01-31
Title
WP Visitor Statistics (Real Time Traffic) < 5.5 - Arbitrary IP Address Exclusion to Stored XSS
Slug
wp-stats-manager
Published
2022-02-14
Title
WP Visitor Statistics (Real Time Traffic) < 5.6 - Subscriber+ SQL Injection
Slug
wp-stats-manager
Published
2022-07-05
Title
WP Visitor Statistics (Real Time Traffic) < 5.8 - Unauthenticated SQLi
Slug
wp-stats-manager
Published
2023-01-17
Title
WP Visitor Statistics (Real Time Traffic) < 6.5 - Contributor+ Stored XSS via Shortcode
Slug
wp-stats-manager
Published
2023-04-24
Title
WP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLi
Slug
wp-stats-manager
Published
2024-02-02
Title
WP Visitor Statistics (Real Time Traffic) < 6.9.5 - Sensitive Information Exposure via Log File
Slug
wp-stats-manager
Published
2025-01-06
Title
WP Visitor Statistics (Real Time Traffic) < 7.6 - Missing Authorization
Slug
wp-stats-manager
Published
2025-01-24
Title
WP Visitor Statistics (Real Time Traffic) < 7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-stats-manager
Published
2025-06-19
Title
WP Visitor Statistics (Real Time Traffic) <= 8.4 - Missing Authorization
Slug
wp-stats-manager
Published
2025-07-03
Title
WP Visitor Statistics (Real Time Traffic) < 7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-stats-manager
Published
2025-08-20
Title
WP Visitor Statistics (Real Time Traffic) < 8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-stats-manager
Published
2025-12-15
Title
Visitor Statistics (Real Time Traffic) < 8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-stats-manager
Published
2026-04-07
Title
WP Visitor Statistics (Real Time Traffic) < 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height' Shortcode Attribute
Slug
wp-sticky-side-buttons
Published
2025-04-17
Title
WP Sticky Side Buttons <= 2.1 - Cross-Site Request Forgery
Slug
wp-sticky-social
Published
2023-06-19
Title
WP Sticky Social 1.0.1 - Stored XSS via CSRF
Slug
wp-store-locator
Published
2025-07-31
Title
Store Locator < 2.2.261 - Authenticated (Contributor+) PHP Object Injection
Slug
wp-store-locator-extenders
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-store-locator-extenders
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-storymap
Published
2025-08-14
Title
StoryMap <= 2.1 - Cross-Site Request Forgery