WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-appbox
Published
2024-12-23
Title
WP-Appbox < 4.5.4 - Reflected Cross-Site Scripting
Slug
wp-appbox
Published
2025-02-20
Title
WP-Appbox < 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via appbox Shortcode
Slug
wp-applink
Published
2025-07-23
Title
WP Applink <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter
Slug
wp-appointment-schedule-booking-system
Published
2016-10-03
Title
WordPress Appointment Schedule Booking System - Authenticated Stored XSS
Slug
wp-armour-extended
Published
2024-08-26
Title
WP Armour Extended < 1.32 - Reflected Cross-Site Scripting
Slug
wp-armour-extended
Published
2024-08-26
Title
WP Armour Extended < 1.32 - Cross-Site Request Forgery
Slug
wp-asambleas
Published
2025-02-17
Title
WP-Asambleas <= 2.85.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-asambleas
Published
2025-02-24
Title
WP-Asambleas <= 2.85.0 - Unauthenticated Arbitrary Shortcode Execution
Slug
wp-asambleas
Published
2025-01-13
Title
WP-Asambleas <= 2.85.0 - Reflected Cross-Site Scripting
Slug
wp-asset-clean-up
Published
2020-09-09
Title
Asset CleanUp: Page Speed Booster < 1.3.6.7 - CSRF & XSS
Slug
wp-asset-clean-up
Published
2022-01-03
Title
Asset CleanUp < 1.3.8.5 - Reflected Cross-Site Scripting via AJAX Action
Slug
wp-asset-clean-up
Published
2022-01-03
Title
Asset CleanUp < 1.3.8.5 - Reflected Cross-Site Scripting
Slug
wp-asset-clean-up
Published
2022-09-28
Title
Asset CleanUp: Page Speed Booster < 1.3.8.5 - Reflected Cross-Site Scripting
Slug
wp-asset-clean-up
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-asset-clean-up
Published
2024-08-16
Title
Asset CleanUp: Page Speed Booster < 1.3.9.4 - Missing Authorization
Slug
wp-asset-clean-up
Published
2024-11-27
Title
Asset CleanUp: Page Speed Booster < 1.3.9.9 - Authenticated (Admin+) Server-Side Request Forgery
Slug
wp-athletics
Published
2022-05-17
Title
WP Athletics <= 1.1.7 - Subscriber+ Stored Cross-Site Scripting
Slug
wp-athletics
Published
2022-05-17
Title
WP Athletics <= 1.1.7 - Reflected Cross-Site Scripting
Slug
wp-attachment-export
Published
2015-07-15
Title
WP Attachment Export < 0.2.4 - Unauthenticated Posts Download
Slug
wp-attachments
Published
2022-10-18
Title
WP Attachments < 5.0.5 - Admin+ Stored Cross-Site Scripting
Slug
wp-attachments
Published
2022-12-21
Title
WP Attachments < 5.0.6 - Admin+ Stored XSS
Slug
wp-attachments
Published
2023-10-16
Title
WP Attachments < 5.0.12 - Arbitrary Settings Update via CSRF
Slug
wp-attachments
Published
2025-05-27
Title
WP Attachments < 5.1 - Reflected Cross-Site Scripting via attachment_id Parameter
Slug
wp-attachments
Published
2025-12-31
Title
Attachments <= 5.2 - Missing Authorization
Slug
wp-attest
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius