WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wordpress-simple-paypal-shopping-cart
Published
2025-04-30
Title
WordPress Simple PayPal Shopping Cart < 5.1.4 - Insecure Direct Object Reference
Slug
wordpress-simple-paypal-shopping-cart
Published
2025-04-30
Title
WordPress Simple PayPal Shopping Cart < 5.1.4 - Insecure Direct Object Reference via 'quantity'
Slug
wordpress-simple-paypal-shopping-cart
Published
2025-04-30
Title
WordPress Simple PayPal Shopping Cart < 5.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
wordpress-simple-shout-box
Published
2014-08-01
Title
wordpress-simple-shout-box - SQL Injection
Slug
wordpress-social-login
Published
2014-04-25
Title
Wordpress Social Login < 2.1.5 - XSS
Slug
wordpress-social-login
Published
2023-05-31
Title
WordPress Social Login <= 3.0.4 - Reflected XSS
Slug
wordpress-social-login
Published
2023-05-31
Title
WordPress Social Login <= 3.0.4 - Admin+ Stored XSS
Slug
wordpress-social-login
Published
2023-09-05
Title
WordPress Social Login <= 3.0.4 - Contributor+ Stored XSS
Slug
wordpress-social-ring
Published
2014-08-01
Title
Social Ring 1.0 - share.php url Parameter Reflected XSS
Slug
wordpress-sql-backup
Published
2025-03-24
Title
WordPress SQL Backup <= 3.5.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
wordpress-tabs-slides
Published
2023-01-19
Title
WP Tabs Slides <= 2.0.3 - CSRF
Slug
wordpress-theme-demo-bar
Published
2025-03-20
Title
Theme Demo Bar <= 1.6.3 - Reflected Cross-Site Scripting
Slug
wordpress-toolbar
Published
2024-01-03
Title
WordPress Toolbar <= 2.2.6 - Open Redirect
Slug
wordpress-tooltips
Published
2024-04-05
Title
WordPress Tooltips < 9.5.3 - Cross-Site Request Forgery
Slug
wordpress-tooltips
Published
2024-03-26
Title
WordPress Tooltips < 9.4.5 - Authenticated (Contributor+) SQL Injection
Slug
wordpress-tooltips
Published
2025-12-31
Title
Tooltips <= 10.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wordpress-twitterbot
Published
2024-01-23
Title
Marketing Twitter Bot <= 1.11 - Settings Update to Stored XSS via CSRF
Slug
wordpress-users
Published
2024-01-03
Title
WordPress Users <= 1.4 - Settings Update via CSRF
Slug
wordpress-video
Published
2024-10-14
Title
WordPress Video <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wordpressplugin-upgrade-time-out-plugin
Published
2025-03-19
Title
Plugin Upgrade Time Out <= 1.0 - Stored XSS via CSRF
Slug
wordprezi
Published
2023-01-11
Title
WordPrezi < 0.9 - Contributor+ Strored XSS
Slug
wordspew
Published
2014-08-01
Title
Wordspew - Remote SQL Injection
Slug
wordsurvey
Published
2024-08-20
Title
WordSurvey <= 3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via sounding_title Parameter
Slug
wordtube
Published
2014-08-01
Title
plugin wordTube <= 1.43 - (wpPATH) RFI
Slug
work-the-flow-file-upload
Published
2014-08-01
Title
Work The Flow File Upload < 2.4 - wp-admin/admin-ajax.php accept_file_types Parameter Manipulation File Upload Restriction Bypass