WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-stats-manager
Published
2025-08-20
Title
WP Visitor Statistics (Real Time Traffic) < 8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-stats-manager
Published
2025-12-15
Title
Visitor Statistics (Real Time Traffic) < 8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-stats-manager
Published
2026-04-07
Title
WP Visitor Statistics (Real Time Traffic) < 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height' Shortcode Attribute
Slug
wp-sticky-side-buttons
Published
2025-04-17
Title
WP Sticky Side Buttons <= 2.1 - Cross-Site Request Forgery
Slug
wp-sticky-social
Published
2023-06-19
Title
WP Sticky Social 1.0.1 - Stored XSS via CSRF
Slug
wp-store-locator
Published
2025-07-31
Title
Store Locator < 2.2.261 - Authenticated (Contributor+) PHP Object Injection
Slug
wp-store-locator
Published
2026-04-22
Title
WP Store Locator < 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsl_address' Post Meta
Slug
wp-store-locator-extenders
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-store-locator-extenders
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-storymap
Published
2025-08-14
Title
StoryMap <= 2.1 - Cross-Site Request Forgery
Slug
wp-storymap
Published
2025-09-05
Title
StoryMap <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-strava
Published
2024-11-12
Title
WP-Strava <= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
wp-stripe-checkout
Published
2022-11-22
Title
WP Stripe Checkout < 1.2.2.21 - Contributor+ Stored XSS
Slug
wp-stripe-checkout
Published
2023-12-28
Title
WP Stripe Checkout < 1.2.2.38 - Sensitive Information Exposure via Debug Log
Slug
wp-stripe-checkout
Published
2024-04-16
Title
WP Stripe Checkout < 1.2.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
wp-stripe-donation
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-stripe-donation
Published
2023-02-20
Title
Accept Stripe Donation - AidWP < 3.1.6 - CSRF
Slug
wp-stripe-donation
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-stripe-donation
Published
2024-10-24
Title
WordPress Stripe Donation and Payment Plugin < 3.2.4 - Missing Authorization
Slug
wp-stripe-donation
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Slug
wp-stripe-express
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-stripe-express
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-stripe-express
Published
2026-06-05
Title
Express Payment For Stripe < 1.28.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
wp-stripe-global-payments
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-stripe-global-payments
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting