WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wallet-system-for-woocommerce
Published
2025-12-29
Title
Wallet System for WooCommerce < 2.7.4 - Authenticated (Subscriber+) Information Exposure
Slug
wallet-system-for-woocommerce
Published
2026-01-16
Title
Wallet System for WooCommerce < 2.7.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation
Slug
wallet-system-for-woocommerce
Published
2026-04-29
Title
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.7.6 - Missing Authorization
Slug
wallet-system-for-woocommerce
Published
2026-06-29
Title
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.7.7 - Missing Authorization
Slug
wallwisher-shortcode
Published
2025-11-20
Title
Padlet Shortcode <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
wamate-confirm
Published
2026-02-10
Title
WaMate Confirm < 2.0.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Phone Number Blocking/Unblocking
Slug
wangguard
Published
2016-08-02
Title
WangGuard <= 1.7.1 - Cross-Site Scripting (XSS)
Slug
wangguard
Published
2017-01-17
Title
WangGuard <= 1.7.2 - Authenticated Reflected Cross-Site Scripting (XSS)
Slug
wappointment
Published
2021-09-27
Title
Wappointment < 2.2.5 - Unauthenticated Stored Cross-Site Scripting
Slug
wappointment
Published
2024-04-12
Title
Wappointment < 2.6.1 - Admin+ SSRF
Slug
wappointment
Published
2025-11-17
Title
Wappointment < 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wappointment
Published
2025-12-21
Title
Wappointment <=2.7.2 - Missing Authorization
Slug
wappointment
Published
2026-07-01
Title
Appointment Bookings for Zoom GoogleMeet and more – Wappointment < 2.7.7 - Unauthenticated Insecure Direct Object Reference via Predictable 'edit_key' / 'appointmentkey' Parameter
Slug
wapppress-builds-android-app-for-website
Published
2023-12-05
Title
WappPress < 6.0.0 - Unauthenticated Arbitrary File Upload
Slug
wapppress-builds-android-app-for-website
Published
2024-07-11
Title
WappPress < 6.0.5 - Authenticated (Subscriber+) Server-Side Request Forgery
Slug
wapppress-builds-android-app-for-website
Published
2024-08-07
Title
WappPress < 6.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
wassup
Published
2008-01-30
Title
WassUp 1.4.3 - (spy.php to_date) SQL Injection Exploit
Slug
wassup
Published
2016-11-08
Title
WassUp Real Time Analytics <= 1.9 - Cross Site Scripting
Slug
wassup
Published
2012-06-06
Title
Wassup < 1.8.3.1 - XSS
Slug
wassup
Published
2023-11-06
Title
WassUp Real Time Analytics <= 1.9.4.5 - Unauthenticated Stored XSS
Slug
watcher-elementor
Published
2025-12-31
Title
Watcher for Elementor <= 1.0.9 - Missing Authorization
Slug
watchtowerhq
Published
2022-11-01
Title
WatchTowerHQ < 3.6.16 - Unauthenticated Arbitrary File Deletion
Slug
watchtowerhq
Published
2022-11-01
Title
WatchTowerHQ < 3.6.16 - Unauthenticated Arbitrary File Access
Slug
watchtowerhq
Published
2024-10-25
Title
WatchTowerHQ < 3.10.4 - Authentication Bypass to Administrator due to Missing Empty Value Check
Slug
watchtowerhq
Published
2025-12-11
Title
WatchTowerHQ < 3.16.1 - Authenticated (Administrator+) Arbitrary File Read via 'wht_download_big_object_origin' Parameter