WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
youtube-playlist-player
Published
2023-05-23
Title
YouTube Playlist Player < 4.6.5 - Cross-Site Request Forgery (CSRF)
Slug
youtube-playlist-player
Published
2023-10-18
Title
YouTube Playlist Player < 4.6.8 - Contributor+ Stored XSS
Slug
youtube-shortcode
Published
2023-01-19
Title
Youtube Shortcode <= 1.8.5 - Contributor+ Stored XSS
Slug
youtube-showcase
Published
2023-08-16
Title
Video Gallery & Management < 3.3.6 - Settings Update via CSRF
Slug
youtube-showcase
Published
2024-05-20
Title
YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress < 3.4.0 - Missing Authorization to Arbitrary Post/Page Creation
Slug
youtube-showcase
Published
2025-08-25
Title
YouTube Showcase < 3.5.2 - Unauthenticated PHP Object Injection
Slug
youtube-showcase
Published
2025-09-23
Title
Multiple Plugins by eMarket Design <= Various Versions - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
youtube-simple-gallery
Published
2025-06-05
Title
YouTube Simple Gallery <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
youtube-simplegallery
Published
2025-03-28
Title
YouTube SimpleGallery <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
youtube-speedload
Published
2023-11-09
Title
Youtube SpeedLoad <= 0.6.3 - Cross-Site Request Forgery
Slug
youtube-video-inserter
Published
2021-09-09
Title
YouTube Video Inserter <= 1.2.1.0 - Reflected Cross-Site Scripting
Slug
youtube-video-player
Published
2021-06-28
Title
YouTube Embed, Playlist and Popup < 2.3.9 - Contributor+ Stored XSS
Slug
youtube-video-player
Published
2023-01-23
Title
YouTube Embed, Playlist and Popup by WpDevArt < 2.6.4 - Admin+ Stored XSS
Slug
youtube-video-player
Published
2025-07-03
Title
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library
Slug
youtube-widget-responsive
Published
2023-09-19
Title
Widget Responsive for Youtube < 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
youzify
Published
2021-06-28
Title
Youzify < 1.0.7 - Stored Cross-Site Scripting via Biography
Slug
youzify
Published
2022-07-11
Title
Youzify < 1.2.0 - Unauthenticated SQLi
Slug
youzify
Published
2023-01-24
Title
Youzify < 1.2.2 - Contributor+ Stored XSS
Slug
youzify
Published
2023-11-03
Title
Youzify < 1.2.3 - Insecure Direct Object Reference
Slug
youzify
Published
2024-07-04
Title
Youzify < 1.2.6 - Authenticated (Contributor+) SQL Injection
Slug
youzify
Published
2024-06-19
Title
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress < 1.2.6 - Authenticated (Contributor+) SQL Injection
Slug
youzify
Published
2024-07-24
Title
Youzify < 1.2.8 - Missing Authorization
Slug
youzify
Published
2024-10-09
Title
Youzify < 1.3.1 - Subscriber+ Arbitrary Attachment Deletion
Slug
youzify
Published
2024-10-09
Title
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress < 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via youzify_media Shortcode
Slug
youzify
Published
2025-01-24
Title
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress By KaineLabs < 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Review Deletion