WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wpematico
Published
2021-09-29
Title
WPeMatico RSS Feed Fetcher < 2.6.12 - Admin+ Stored Cross-Site Scripting
Slug
wpematico
Published
2025-07-25
Title
WPeMatico RSS Feed Fetcher < 2.8.8 - Cross-Site Request Forgery to Plugin Deactivation via handle_feedback_submission Function
Slug
wpematico
Published
2025-09-22
Title
WPeMatico RSS Feed Fetcher < 2.8.11 - Authenticated (Subscriber+) Sensitive Information Exposure
Slug
wpematico
Published
2025-11-04
Title
WPeMatico RSS Feed Fetcher < 2.8.12 - Authenticated (Subscriber+) Server-Side Request Forgery via wpematico_test_feed
Slug
wpematico
Published
2025-11-18
Title
WPeMatico RSS Feed Fetcher < 2.8.13 - Contributor+ Stored XSS
Slug
wpematico
Published
2025-05-29
Title
WPeMatico RSS Feed Fetcher < 2.8.4 - Missing Authorization
Slug
wpeventplus
Published
2025-04-22
Title
WordPress Events Calendar Registration & Tickets <= 2.6.0 - Reflected Cross-Site Scripting
Slug
wpeventplus
Published
2025-05-16
Title
WordPress Events Calendar Registration & Tickets <= 2.6.0 - Unauthenticated PHP Object Injection
Slug
wpeventticketing
Published
2025-03-24
Title
WP Event Ticketing <= 1.3.4 - Reflected Cross-Site Scripting
Slug
wpex-replace
Published
2025-01-07
Title
WPEX Replace DB Urls <= 0.4.0 - Reflected Cross-Site Scripting
Slug
wpexperts-square-for-give
Published
2024-09-26
Title
WPExperts Square For GiveWP < 1.3.2 - Subscriber+ SQL Injection
Slug
wpexperts-square-for-give
Published
2025-02-20
Title
WPExperts Square For GiveWP < 1.3.2 - Authenticated (Subscriber+) SQL Injection
Slug
wpextended
Published
2024-06-27
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.0 - Unauthenticated Stored Cross-Site Scripting
Slug
wpextended
Published
2024-09-03
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.9 - Reflected Cross-Site Scripting via selected_option
Slug
wpextended
Published
2024-09-03
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.9 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File Download
Slug
wpextended
Published
2024-09-03
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.9 - Reflected Cross-Site Scripting via page
Slug
wpextended
Published
2024-09-03
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.9 - Authenticated (Subscriber+) Sensitive Information Exposure
Slug
wpextended
Published
2024-09-03
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.9 - Authenticated (Subscriber+) Arbitrary Options Update
Slug
wpextended
Published
2024-09-03
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.9 - Insecure Direct Object Reference
Slug
wpextended
Published
2024-09-03
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.9 - Missing Authorization to Admin Username Change
Slug
wpextended
Published
2024-09-30
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.9 - Reflected Cross-Site Scripting
Slug
wpextended
Published
2024-10-16
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.10 - Reflected Cross-Site Scripting
Slug
wpextended
Published
2025-01-07
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.12 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
wpextended
Published
2025-01-07
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.12 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution
Slug
wpextended
Published
2025-01-17
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.13 - Unauthenticated SQL Injection via Login Attempts Module