WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wpcomplete
Published
2025-06-19
Title
WPComplete < 2.9.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wpcomplete
Published
2025-09-22
Title
WPComplete < 2.9.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wpcomplete
Published
2025-10-24
Title
WPComplete < 2.9.5.4 - Missing Authorization
Slug
wpcomplete
Published
2026-05-29
Title
WPComplete < 2.9.5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
wpcomplete
Published
2026-06-26
Title
WPComplete < 2.9.5.6 - Missing Authorization
Slug
wpcomplete
Published
2026-08-20
Title
WPComplete < 2.9.5.7 - Unauthenticated Stored Cross-Site Scripting
Slug
wpcomplete
Published
2026-10-08
Title
WPComplete < 2.9.5.7 - Cross-Site Request Forgery
Slug
wpcomplete
Published
2026-09-18
Title
WPComplete < 2.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute
Slug
wpcomponent
Published
2026-09-10
Title
WP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option Update
Slug
wpconsent-cookies-banner-privacy-suite
Published
2026-10-15
Title
WPConsent < 1.2.0 - Unauthenticated Stored XSS via Comment Content (mXSS)
Slug
wpcrm
Published
2025-06-12
Title
WPCRM - CRM for Contact form CF7 & WooCommerce <= 3.2.0 - Unauthenticated SQL Injection
Slug
wpcrm
Published
2025-06-23
Title
WPCRM - CRM for Contact form CF7 & WooCommerce <= 3.2.0 - Reflected Cross-Site Scripting
Slug
wpcs-content-scheduler
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wpcs-content-scheduler
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wpcs-wp-custom-search
Published
2024-05-06
Title
WPCS ( WordPress Custom Search ) <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
wpcues-basic-quiz
Published
2026-10-09
Title
WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submission
Slug
wpdash-notes
Published
2024-11-22
Title
WPDash Notes <= 1.3.5 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
Slug
wpdatatables
Published
2014-11-25
Title
wpDataTables < 1.5.4 - Unauthenticated Shell Upload
Slug
wpdatatables
Published
2014-11-25
Title
wpDataTables < 1.5.4 - Unauthenticated SQL Injection
Slug
wpdatatables
Published
2019-10-11
Title
wpDataTables < 2.0.12 - Cross-Site Scripting (XSS) & SQL Injection
Slug
wpdatatables
Published
2021-02-04
Title
wpDataTables < 3.4.1 - Unauthenticated SQL Injection
Slug
wpdatatables
Published
2021-03-16
Title
wpDataTables < 3.4.2 - Improper Access Control leading to Table Permission Takeover
Slug
wpdatatables
Published
2021-03-16
Title
wpDataTables < 3.4.2 - Improper Access Control leading to Table Data Deletion
Slug
wpdatatables
Published
2021-03-16
Title
wpDataTables < 3.4.2 - Blind SQL Injection via start Parameter
Slug
wpdatatables
Published
2021-03-16
Title
wpDataTables < 3.4.2 - Blind SQL Injection via length Parameter