WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wpextended
Published
2024-09-03
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.9 - Reflected Cross-Site Scripting via page
Slug
wpextended
Published
2024-09-03
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.9 - Authenticated (Subscriber+) Sensitive Information Exposure
Slug
wpextended
Published
2024-09-03
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.9 - Authenticated (Subscriber+) Arbitrary Options Update
Slug
wpextended
Published
2024-09-03
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.9 - Insecure Direct Object Reference
Slug
wpextended
Published
2024-09-03
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.9 - Missing Authorization to Admin Username Change
Slug
wpextended
Published
2024-09-30
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.9 - Reflected Cross-Site Scripting
Slug
wpextended
Published
2024-10-16
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.10 - Reflected Cross-Site Scripting
Slug
wpextended
Published
2025-01-07
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.12 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
wpextended
Published
2025-01-07
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.12 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution
Slug
wpextended
Published
2025-01-17
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.13 - Unauthenticated SQL Injection via Login Attempts Module
Slug
wpextended
Published
2025-02-11
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.14 - Missing Authorization to Unauthenticated Post Order Manipulation
Slug
wpextended
Published
2025-03-27
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.15 - Reflected Cross-Site Scripting
Slug
wpextended
Published
2025-05-27
Title
WP Extended < 3.0.16 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
wpextended
Published
2026-03-21
Title
The Ultimate WordPress Toolkit – WP Extended < 3.2.5 - Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module
Slug
wpf-add-on-by-click5
Published
2026-10-09
Title
click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update
Slug
wpf-add-on-by-click5
Published
2026-10-09
Title
click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications
Slug
wpf-ultimate-carousel
Published
2025-01-16
Title
WpF Ultimate Carousel <= 1.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wpfaqblock
Published
2026-03-20
Title
WPFAQBlock– FAQ & Accordion Plugin For Gutenberg < 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute
Slug
wpfavicon
Published
2024-07-06
Title
WPFavicon <= 2.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Slug
wpfilesearch
Published
2025-01-16
Title
WordPress File Search <= 1.2 - Reflected Cross-Site Scripting
Slug
wpformify
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wpformify
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wpformify
Published
2026-08-04
Title
WPFormify < 1.1.2 - Missing Authorization
Slug
wpforms
Published
2022-10-18
Title
WPForms Pro < 1.7.7 - CSV Injection
Slug
wpforms
Published
2024-01-19
Title
WPForms Pro < 1.8.5.4 - Unauthenticated Stored Cross-Site Scripting via Form Submission