WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wpsimpletools-log-viewer
Published
2024-02-09
Title
Basic Log Viewer <= 1.0.4 - Cross-Site Request Forgery via wpst_lw_viewer
Slug
wpsimpletools-upload-limit
Published
2023-03-03
Title
Manage Upload Limit <= 1.0.4 - Reflected XSS
Slug
wpsite-follow-us-badges
Published
2024-05-01
Title
Follow Us Badges < 3.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsite_follow_us_badges Shortcode
Slug
wpsite-follow-us-badges
Published
2025-04-01
Title
Follow Us Badges <= 3.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wpsite-shortcode
Published
2025-11-20
Title
WPSite Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wpsitemap
Published
2025-04-01
Title
WP Sitemap <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wpslacksync
Published
2019-11-12
Title
WP Slacksync < 1.8.6 - Slack Access Token Disclosure
Slug
wpsol
Published
2025-01-03
Title
wpSOL <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
wpsolr-free
Published
2025-04-09
Title
WPSolr < 24.0.1 - Privilege Escalation via CSRF
Slug
wpsolr-search-engine
Published
2016-04-12
Title
WPSOLR <= 8.6 - Unauthenticated Reflected Cross-Site Scripting (XSS)
Slug
wpspeed
Published
2025-05-07
Title
WPSpeed < 2.6.6 - Cross-Site Request Forgery
Slug
wpspx
Published
2024-09-24
Title
WPSPX <= 1.0.2 - Unauthenticated Local File Inclusion
Slug
wpsso
Published
2024-12-30
Title
WPSSO Core < 18.18.2 - Missing Authorization
Slug
wpstickybar-sticky-bar-sticky-header
Published
2024-07-09
Title
WpStickyBar <= 2.1.0 - Unauthenticated SQLi
Slug
wpstickybar-sticky-bar-sticky-header
Published
2024-07-09
Title
WpStickyBar <= 2.1.0 - Reflected XSS
Slug
wpstorecart
Published
2014-08-01
Title
wpStoreCart 2.5.27-2.5.29 - Arbitrary File Upload
Slug
wpstorecart
Published
2026-09-10
Title
IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php
Slug
wpstream
Published
2023-07-20
Title
WpStream < 4.5.5 - Local Event Settings Update via CSRF
Slug
wpstream
Published
2023-03-02
Title
WpStream < 4.4.10.6 - Settings Update via CSRF
Slug
wpstream
Published
2025-12-29
Title
WpStream < 4.9.6 - Missing Authorization
Slug
wpstream
Published
2025-12-30
Title
WpStream < 4.9.6 - Missing Authorization
Slug
wpstream
Published
2026-04-17
Title
WpStream < 4.11.2 - Subscriber+ File Upload
Slug
wpstream
Published
2026-03-11
Title
WpStream < 4.11.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
Slug
wpsynchro
Published
2023-09-01
Title
WP Synchro < 1.10.0 - Settings Update via CSRF
Slug
wpsynchro
Published
2024-04-11
Title
WP Migration Plugin DB & Files – WP Synchro < 1.11.3 - Cross-Site Request Forgery