WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-smart-import
Published
2024-04-16
Title
WP Smart Import : Import any XML File to WordPress < 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
wp-smart-import
Published
2025-01-03
Title
WP Smart Import : Import any XML File to WordPress < 1.1.3 - Reflected Cross-Site Scripting
Slug
wp-smart-import
Published
2025-05-21
Title
WP Smart Import < 1.1.4 - Unauthenticated Local File Inclusion
Slug
wp-smart-preloader
Published
2023-01-20
Title
WP Smart Preloader < 1.15.1 - Admin+ Stored XSS
Slug
wp-smart-tool-tip
Published
2025-01-16
Title
WP Smart Tooltip <= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
wp-smart-tv
Published
2025-01-14
Title
WP Smart TV < 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-smiley
Published
2015-05-29
Title
WP Smiley <= 1.4.1 - CSRF & Cross-Site Scripting (XSS)
Slug
wp-sms
Published
2021-07-26
Title
WP SMS < 5.4.13 - Authenticated Stored Cross-Site Scripting
Slug
wp-sms
Published
2021-06-30
Title
WP SMS < 5.4.9.1 - Reflected Cross-Site Scripting (XSS)
Slug
wp-sms
Published
2023-05-15
Title
WP SMS < 6.1.5 - Reflected XSS
Slug
wp-sms
Published
2023-03-02
Title
WP SMS < 6.0.4.1 - Information Disclosure via REST API
Slug
wp-sms
Published
2023-07-07
Title
WP SMS < 6.2.0 - User Unsubscribe via CSRF
Slug
wp-sms
Published
2024-01-02
Title
WP SMS < 6.5.1 - Contributor+ SQLi to Reflected XSS
Slug
wp-sms
Published
2024-01-02
Title
WP SMS < 6.5.1 - Cross-Site Request Forgery to Subscriber Deletion
Slug
wp-sms
Published
2024-02-05
Title
WP SMS < 6.5.3 - Reflected Cross-Site Scripting via 'page'
Slug
wp-sms
Published
2024-02-14
Title
WP SMS < 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
wp-sms
Published
2024-01-12
Title
WP SMS < 6.5.2 - Contributor+ Stored Cross-Site Scripting
Slug
wp-sms
Published
2024-03-28
Title
WP SMS < 6.6.3 - Cross-Site Request Forgery
Slug
wp-sms
Published
2024-05-13
Title
WP SMS < 6.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
wp-sms
Published
2024-08-16
Title
WP SMS < 6.9.4 - Missing Authorization
Slug
wp-sms
Published
2025-10-16
Title
WP SMS < 7.0.2 - Missing Authorization
Slug
wp-sms
Published
2026-02-10
Title
WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce < 7.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
wp-sms
Published
2025-06-14
Title
SMS < 7.0 - Authenticated (Administrator+) SQL Injection
Slug
wp-sms
Published
2026-04-23
Title
WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce < 7.2.2 - Authenticated (Subscriber+) Information Exposure
Slug
wp-sms-vatansms-com
Published
2026-05-19
Title
VatanSMS WP SMS <= 1.01 - Reflected Cross-Site Scripting via 'page' Parameter