WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
w3-total-cache
Published
2025-01-13
Title
W3 Total Cache < 2.8.2 - Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation
Slug
w3-total-cache
Published
2025-10-27
Title
W3 Total Cache < 2.8.13 - Unauthenticated Command Injection
Slug
w3s-cf7-zoho
Published
2021-08-09
Title
Titan Framework <= 1.12.1 - Reflected Cross-Site Scripting (XSS)
Slug
w3s-cf7-zoho
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
w3s-cf7-zoho
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
w3s-cf7-zoho
Published
2025-09-26
Title
W3SCloud Contact Form 7 to Zoho CRM <= 3.0 - Cross-Site Request Forgery
Slug
w3speedster-wp
Published
2024-01-31
Title
W3SPEEDSTER < 7.20 - Settings Update via CSRF
Slug
w3speedster-wp
Published
2024-10-29
Title
W3SPEEDSTER < 7.27 - Admin+ RCE
Slug
w3speedster-wp
Published
2024-11-11
Title
W3SPEEDSTER < 7.27 - Cross-Site Request Forgery
Slug
w3speedster-wp
Published
2025-01-16
Title
W3SPEEDSTER <= 7.33 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
w3swoozoho
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
w4-post-list
Published
2023-03-22
Title
W4 Post List < 2.4.6 - Reflected XSS
Slug
w4-post-list
Published
2023-03-22
Title
W4 Post List < 2.4.6 - Contributor+ Stored XSS
Slug
w4-post-list
Published
2023-03-22
Title
W4 Post List < 2.4.6 - Subscriber+ Password Protected Post Content Disclosure
Slug
w4-post-list
Published
2023-03-08
Title
W4 Post List < 2.4.5 - Contributor+ Stored XSS
Slug
wa-chatbox-manager
Published
2025-03-27
Title
Chatbox Manager < 1.2.3 - Missing Authorization
Slug
wa-chatbox-manager
Published
2025-07-16
Title
Chatbox Manager < 1.2.6 - Missing Authorization
Slug
wa-chatbox-manager
Published
2025-08-27
Title
Chatbox Manager < 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wa-form-builder
Published
2016-12-05
Title
WA Form Builder 1.1 - Unauthenticated SQL Injection
Slug
wa-sticky-button
Published
2022-08-01
Title
WP Sticky Button < 1.4.1 - Unauthenticated Arbitrary Settings Update to Stored XSS
Slug
wa11y
Published
2025-03-24
Title
wA11y – The Web Accessibility Toolbox <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
wadi-addons-for-elementor
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wadi-survey
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wadi-survey
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wah-forms
Published
2025-01-16
Title
WAH Forms <= 1.0 - Missing Authorization