WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wordpress-database-reset
Published
2024-02-20
Title
Database Reset < 3.23 - Cross-Site Request Forgery to WP Reset Plugin Installation
Slug
wordpress-donation-plugin-with-goals-and-paypal-ipn-by-nonprofitcmsorg
Published
2014-08-01
Title
Donation <= 1.0 - SQL Injection
Slug
wordpress-easy-allopass
Published
2025-06-05
Title
Wp Easy Allopass <= 4.1.1 - Cross-Site Request Forgery
Slug
wordpress-easy-paypal-payment-or-donation-accept-plugin
Published
2023-01-17
Title
Easy Accept Payments for PayPal < 4.9.10 - Contributor+ Stored XSS
Slug
wordpress-easy-paypal-payment-or-donation-accept-plugin
Published
2024-04-25
Title
Easy Accept Payments < 5.0 - Missing Authorization
Slug
wordpress-ecommerce
Published
2017-10-01
Title
MarketPress <= 3.2.6 - PHP Object Injection
Slug
wordpress-feed-statistics
Published
2014-08-07
Title
Feed Statistics < 4.0 - Open Redirect
Slug
wordpress-feed-statistics
Published
2023-10-16
Title
Feed Statistics <= 4.1 - Arbitrary Settings Update via CSRF
Slug
wordpress-file-monitor
Published
2016-06-22
Title
WordPress File Monitor - Stored Cross-Site Scripting (XSS)
Slug
wordpress-file-upload-pro
Published
2022-02-14
Title
WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Shortcode
Slug
wordpress-file-upload-pro
Published
2022-02-14
Title
WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVG
Slug
wordpress-file-upload-pro
Published
2022-03-01
Title
WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCE
Slug
wordpress-filter
Published
2024-12-12
Title
WordPress Filter <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
wordpress-firewall-2
Published
2017-04-05
Title
Download WordPress Firewall 2 - Authenticated Stored XSS/CSRF
Slug
wordpress-flash-uploader
Published
2014-09-22
Title
Flash Uploader <= 3.1.2 - Arbitrary Comm& Execution
Slug
wordpress-flat-countdown
Published
2025-07-08
Title
Responsive Coming Soon Landing Page / Holding Page for WordPress <= 3.0 - Authenticated (Susbcriber+) Privilege Escalation
Slug
wordpress-form-manager
Published
2015-10-23
Title
Form Manager <= 1.7.2 - Authenticated Remote Command Execution (RCE)
Slug
wordpress-gallery
Published
2014-08-01
Title
Gallery - "load" Remote File Inclusion
Slug
wordpress-gallery-plugin
Published
2025-01-16
Title
WordPress Gallery Plugin <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
wordpress-gallery-transformation
Published
2017-07-22
Title
wordpress-gallery-transformation 1.0 - Blind SQL Injection
Slug
wordpress-gdpr
Published
2022-01-26
Title
WordPress GDPR & CCPA < 1.9.27 - Unauthenticated Reflected Cross-Site Scripting
Slug
wordpress-gdpr
Published
2022-01-26
Title
WordPress GDPR & CCPA < 1.9.26 - Authenticated Reflected Cross-Site Scripting
Slug
wordpress-gdpr
Published
2024-11-17
Title
WordPress GDPR < 2.0.3 - Missing Authorization to Unauthenticated Arbitrary User Deletion
Slug
wordpress-gdpr
Published
2024-11-17
Title
WordPress GDPR < 2.0.3 - Unauthenticated Stored Cross-Site Scripting
Slug
wordpress-importer
Published
2025-03-25
Title
WordPress Importer < 0.8.4 - Admin+ PHP Object Injection