WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wpbookit
Published
2025-07-23
Title
WPBookit < 1.0.7 - Unauthenticated Arbitrary File Upload via image_upload_handle Function
Slug
wpbookit
Published
2025-11-20
Title
WPBookit < 1.0.7 - Unauthenticated Stored Cross-Site Scripting
Slug
wpbookit
Published
2025-12-12
Title
WPBookit <= 1.0.7 - Customer Deletion via CSRF
Slug
wpbookit
Published
2026-03-03
Title
WPBookit < 1.0.9 - Unauthenticated Stored Cross-Site Scripting via 'wpb_user_name' and 'wpb_user_email' Parameters
Slug
wpbookit
Published
2026-03-03
Title
WPBookit < 1.0.9 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure
Slug
wpbookit-pro
Published
2026-03-23
Title
WPBookit Pro <= 1.6.18 - Subscriber+ Privilege Escalation
Slug
wpbot-pro
Published
2025-01-21
Title
WPBot Pro Wordpress Chatbot < 13.5.6 - Unauthenticated Arbitrary File Upload
Slug
wpbot-pro
Published
2025-01-21
Title
WPBot Pro Wordpress Chatbot < 13.5.6 - Missing Authorization to Authenticated (Subscriber+) Simple Text Response Creation
Slug
wpbot-pro
Published
2025-05-16
Title
WPBot Pro Wordpress Chatbot < 13.7.0 - Authenticated (Subscriber+) Arbitrary File Deletion
Slug
wpbot-pro
Published
2025-05-14
Title
WPBot Pro Wordpress Chatbot <= 12.7.0 - Unauthenticated PHP Object Injection
Slug
wpbricks
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wpbricks
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wpbrutalai
Published
2023-06-05
Title
WP Brutal AI < 2.0.1 - Admin+ Reflected XSS
Slug
wpbrutalai
Published
2023-06-05
Title
WP Brutal AI < 2.0.0 - SQL Injection via CSRF
Slug
wpbrutalai
Published
2023-07-19
Title
WP Brutal AI < 2.06 - Admin+ Stored XSS
Slug
wpbulky-wp-bulk-edit-post-types
Published
2023-07-17
Title
WPBulky < 1.0.10 - Contributor+ Stored Cross-Site Scripting
Slug
wpbulky-wp-bulk-edit-post-types
Published
2025-12-23
Title
WPBulky < 1.1.14 - Authenticated (Author+) SQL Injection
Slug
wpc-admin-columns
Published
2025-04-11
Title
WPC Admin Columns 2.0.6 - 2.1.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update
Slug
wpc-badge-management
Published
2024-03-29
Title
WPC Badge Management for WooCommerce < 2.4.1 - Missing Authorization
Slug
wpc-composite-products
Published
2024-04-26
Title
WPC Composite Products for WooCommerce < 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
wpc-countdown-timer
Published
2025-10-20
Title
WPC Countdown Timer for WooCommerce < 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wpc-grouped-product
Published
2024-04-15
Title
WPC Grouped Product for WooCommerce < 4.4.3 - Missing Authorization
Slug
wpc-name-your-price
Published
2025-10-30
Title
WPC Name Your Price for WooCommerce < 2.2.0 - Unauthenticated Price Alteration
Slug
wpc-product-options
Published
2025-05-16
Title
WPC Product Options for WooCommerce < 3.1.3 - Authenticated (Subscriber+) Local File Inclusion
Slug
wpc-shop-as-customer
Published
2024-10-24
Title
WPC Shop as a Customer for WooCommerce < 1.2.7 - Authenticated (Subscriber+) PHP Object Injection