WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
woozone-contextual
Published
2025-07-31
Title
Amazon Native Shopping Recommendations <= 1.3 - Unauthenticated SQL Injection
Slug
word-2-cash
Published
2026-05-19
Title
Word 2 Cash <= 0.9.2 - Cross-Site Request Forgeryto Stored Cross-Site Scripting via Settings Page
Slug
word-balloon
Published
2022-12-28
Title
Word Balloon < 4.19.3 - Contributor+ Stored XSS via Shortcode
Slug
word-balloon
Published
2023-11-13
Title
Word Balloon < 4.20.3 - Avatar Removal via CSRF
Slug
word-balloon
Published
2024-06-19
Title
Word Balloon < 4.22.0 - Authenticated (Contributor+) Local File Inclusion
Slug
word-count-analysis
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
word-count-and-social-shares
Published
2026-06-23
Title
Word Count and Social Shares <= 1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal
Slug
word-freshener
Published
2025-01-16
Title
Word Freshener <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
word-replacer
Published
2026-06-01
Title
Word Replacer <= 0.4 - Admin+ Stored Cross-Site Scripting via Replacement Parameter
Slug
word-replacer-ultra
Published
2024-01-08
Title
Word Replacer Pro <= 1.0 - Missing Authorization
Slug
word-replacer-ultra
Published
2024-03-15
Title
Word Replacer Pro <= 1.0 - Missing Authorization to Unauthenticated Arbitrary Content Update
Slug
wordable
Published
2020-01-28
Title
Wordable < 3.1.2 - Plugin's Authentication Bypass
Slug
wordapp
Published
2023-05-30
Title
Wordapp <= 1.5.0 - Authorization Bypass via Insufficiently Unique Cryptographic Signature
Slug
wordapp
Published
2025-06-05
Title
Wordapp <= 1.7.0 - Missing Authorization
Slug
wordapp-mobile-app
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wordapp-mobile-app
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wordcamp-talks
Published
2017-10-18
Title
WordCamp Talks <= 1.0.0-beta2 - Formula injection via CSV exports
Slug
wordcents
Published
2026-01-16
Title
Eli's WordCents adSense Widget with Analytics <= 1.3.03.27 - Reflected Cross-Site Scripting
Slug
wordfence
Published
2014-08-01
Title
Wordfence 3.8.6 - lib/IPTraf.php User-Agent Header Stored XSS
Slug
wordfence
Published
2014-08-01
Title
Wordfence 3.8.1 - Password Creation Restriction Bypass
Slug
wordfence
Published
2014-08-01
Title
Wordfence 3.8.1 - wp-admin/admin.php whois Parameter Stored XSS
Slug
wordfence
Published
2014-08-01
Title
Wordfence 3.3.5 - XSS & IAA
Slug
wordfence
Published
2014-09-22
Title
Wordfence 5.2.4 - Unspecified Issue
Slug
wordfence
Published
2014-09-22
Title
Wordfence 5.2.4 - IPTraf.php URI Request Stored XSS
Slug
wordfence
Published
2014-09-22
Title
Wordfence 5.2.3 - Banned IP Functionality Bypass