WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wppricing-builder-lite-responsive-pricing-table-builder
Published
2024-10-14
Title
wpPricing Builder <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wppygments
Published
2014-08-01
Title
wppygments <= 0.3.2 - XSS in ZeroClipboard
Slug
wpqa
Published
2022-04-21
Title
WPQA < 5.2 - Subscriber+ Private Message Disclosure via IDOR
Slug
wpqa
Published
2022-04-21
Title
WPQA < 5.2 - Subscriber+ Stored Cross-Site Scripting via Profile fields
Slug
wpqa
Published
2022-04-21
Title
WPQA < 5.2 - Subscriber+ Arbitrary Profile Picture Deletion via IDOR
Slug
wpqa
Published
2022-05-16
Title
WPQA < 5.5 - Unauthenticated Private Message Disclosure
Slug
wpqa
Published
2022-05-10
Title
WPQA < 5.4 - Reflected Cross-Site Scripting
Slug
wpqa
Published
2022-08-01
Title
WPQA < 5.7 - Subscriber+ Private Message Disclosure via IDOR
Slug
wpqa
Published
2022-10-25
Title
WPQA < 5.9 - Follow/Unfollow via CSRF
Slug
wpqa
Published
2022-12-13
Title
WPQA < 5.9.3 - Missing validation lead to functionality abuse
Slug
wpqa
Published
2024-06-12
Title
WPQA < 6.1.1 - Arbitrary Category and Tag Follow/Unfollow via CSRF
Slug
wpqa
Published
2024-06-12
Title
WPQA < 6.1.1 - Contributor+ Stored XSS
Slug
wpquiz
Published
2025-07-03
Title
WPQuiz <= 0.4.2 - Authenticated (Contributor+) SQL Injection
Slug
wpr-addons-pro
Published
2026-04-16
Title
Royal Elementor Addons < 1.7.1041 - Unauthenticated Stored Cross-Site Scripting
Slug
wpr-admin-amplify
Published
2024-11-04
Title
Admin Amplify <= 1.3.0 - Reflected Cross-Site Scripting
Slug
wpradio
Published
2025-01-30
Title
WPRadio – WordPress Radio Streaming Plugin < 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wprecovery
Published
2025-10-02
Title
WPRecovery <= 2.0 - Unauthenticated SQL Injection to Arbitrary File Deletion
Slug
wpremote
Published
2021-11-29
Title
WP Remote < 4.65 - Reflected Cross-Site Scripting
Slug
wpremote
Published
2026-08-24
Title
BlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key Recovery
Slug
wprequal
Published
2025-02-17
Title
Mortgage Lead Capture System < 8.3.1 - Cross-Site Request Forgery to Settings Reset
Slug
wpresidence-core
Published
2026-01-17
Title
Wpresidence Core <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wps-bidouille
Published
2019-07-23
Title
WPS Bidouille < 1.12.4 - Multiple Issues
Slug
wps-bidouille
Published
2025-12-02
Title
WPS Bidouille < 1.33.2 - Missing Authorization
Slug
wps-bidouille
Published
2026-08-17
Title
WPS Bidouille < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_users
Slug
wps-child-theme-generator
Published
2019-07-23
Title
WPS Child Themes Generator <= 1.1 - Path Traversal