WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-review-slider-pro
Published
2026-09-24
Title
WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter
Slug
wp-reviews-plugin-for-google
Published
2023-01-05
Title
Widgets for Google Reviews < 9.8 - Contributor+ Stored XSS
Slug
wp-reviews-plugin-for-google
Published
2023-10-16
Title
Widgets for Google Reviews < 10.9.1 - Arbitrary Settings Update via CSRF
Slug
wp-reviews-plugin-for-google
Published
2023-11-22
Title
Multiple Plugins by Trustindex.io <= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload
Slug
wp-reviews-plugin-for-google
Published
2025-12-05
Title
Widgets for Google Reviews < 13.2.5 - Unauthenticated Stored XSS via Google Reviews
Slug
wp-reviews-plugin-for-google
Published
2025-12-10
Title
Widgets for Google Reviews < 13.2.2 - Contributor+ Stored XSS via trustindex Shortcode
Slug
wp-reviews-plugin-for-google
Published
2026-07-10
Title
Widgets for Google Reviews < 13.3.1 - Editor+ Stored Cross-Site Scripting via fomo-title and fomo-text Parameters
Slug
wp-revive-adserver
Published
2024-12-11
Title
WP-Revive Adserver <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-revive-adserver
Published
2025-01-16
Title
WP-Revive Adserver <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-ride-booking
Published
2025-03-24
Title
WP Ride Booking <= 2.4 - Cross-Site Request Forgery
Slug
wp-roadmap
Published
2023-11-23
Title
WP Roadmap < 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
wp-roadmap
Published
2025-06-19
Title
WP Roadmap < 2.2.0 - Authenticated (Contributor+) SQL Injection
Slug
wp-rocket
Published
2017-06-22
Title
WP Rocket <= 2.10.3 - Local File Inclusion (LFI)
Slug
wp-rocket
Published
2025-10-20
Title
Rocket < 3.20.0.2 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
wp-rocket
Published
2026-08-27
Title
WP Rocket < 3.21.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint
Slug
wp-rocket
Published
2026-10-07
Title
WP Rocket < 3.23.5 - Missing Authorization
Slug
wp-rocket
Published
2026-10-07
Title
WP Rocket < 3.23.5 - Unauthenticated Denial of Service
Slug
wp-rocket
Published
2026-08-28
Title
WP Rocket 3.23.1 - 3.23.3.2 - Unauthenticated Information Exposure
Slug
wp-rollback
Published
2015-06-28
Title
WP Rollback <= 1.2.2 - Cross-Site Scripting (XSS) & CSRF
Slug
wp-rollback
Published
2026-10-08
Title
WP Rollback – Rollback Plugins and Themes < 3.2.0 - Unauthenticated Information Exposure
Slug
wp-roster
Published
2026-10-26
Title
WP Roster < 2.35 - Unauthenticated Roster Member Deletion
Slug
wp-royal-gallery
Published
2014-08-01
Title
wp-royal-gallery - Arbitrary File Upload
Slug
wp-royal-gallery
Published
2014-08-01
Title
SWFUpload - Cross-Site Scripting (XSS)
Slug
wp-rss-aggregator
Published
2021-11-01
Title
WP RSS Aggregator < 4.19.2 - Admin+ Stored Cross-Site Scripting
Slug
wp-rss-aggregator
Published
2021-11-29
Title
WP RSS Aggregator < 4.19.3 - Subscriber+ Stored Cross-Site Scripting