WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
yet-another-related-posts-plugin
Published
2015-05-08
Title
YARPP – Yet Another Related Posts Plugin 4.2.4 - CSRF / XSS / RCE
Slug
yet-another-related-posts-plugin
Published
2023-01-19
Title
YARPP - Yet Another Related Posts Plugin < 5.30.3 - Contributor+ Stored XSS
Slug
yet-another-related-posts-plugin
Published
2023-04-18
Title
YARPP - Yet Another Related Posts Plugin < 5.30.5 - Subscriber+ LFI
Slug
yet-another-related-posts-plugin
Published
2023-04-25
Title
YARPP - Yet Another Related Posts Plugin < 5.30.3 - Subscriber+ SQLi
Slug
yet-another-related-posts-plugin
Published
2023-07-17
Title
YARPP < 5.30.4 - Contributor+ Stored Cross-Site Scripting
Slug
yet-another-related-posts-plugin
Published
2024-02-20
Title
YARPP < 5.30.10 - Admin+ Stored XSS
Slug
yet-another-related-posts-plugin
Published
2024-06-18
Title
YARPP – Yet Another Related Posts Plugin < 5.30.10 - Authenticated(Administrator+) Cross-Site Scripting
Slug
yet-another-related-posts-plugin
Published
2024-08-26
Title
YARPP < 5.30.11 - Missing Authorization
Slug
yet-another-stars-rating
Published
2015-07-06
Title
Yet Another Stars Rating <= 0.9.0 - Authenticated Blind SQL Injection
Slug
yet-another-stars-rating
Published
2019-01-27
Title
Yet Another Stars Rating <= 1.8.6 - PHP Object Injection
Slug
yet-another-stars-rating
Published
2022-02-03
Title
Yet Another Stars Rating < 3.0.0 - Reflected Cross-Site Scripting
Slug
yet-another-stars-rating
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
yet-another-stars-rating
Published
2023-03-03
Title
Yet Another Stars Rating < 3.1.3 - Subscriber+ Stored XSS
Slug
yet-another-stars-rating
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
yet-another-stars-rating
Published
2023-11-27
Title
Yet Another Stars Rating < 3.4.4 - Missing Authorization via init
Slug
yet-another-stars-rating
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Slug
yet-another-webclap-for-wordpress
Published
2025-12-05
Title
Yet Another WebClap for WordPress <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
yext
Published
2025-09-26
Title
Yext <= 1.1.3 - Missing Authorization
Slug
yikes-inc-easy-custom-woocommerce-product-tabs
Published
2022-06-28
Title
Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update
Slug
yikes-inc-easy-custom-woocommerce-product-tabs
Published
2022-11-30
Title
Custom Product Tabs for WooCommerce < 1.8.0 - Admin+ Stored XSS
Slug
yikes-inc-easy-custom-woocommerce-product-tabs
Published
2025-01-06
Title
Custom Product Tabs for WooCommerce <= 1.8.5 - Shop Manager+ PHP Object Injection
Slug
yikes-inc-easy-mailchimp-extender
Published
2014-09-18
Title
Easy Forms for MailChimp 5.0.3 - classes/class.yksemeBase.php Multiple Actions CSRF
Slug
yikes-inc-easy-mailchimp-extender
Published
2014-10-06
Title
Easy Forms for MailChimp 3.0 - 5.0.6 Stored XSS
Slug
yikes-inc-easy-mailchimp-extender
Published
2016-07-13
Title
Easy Forms for MailChimp < 6.1 - Local File Inclusion (LFI)
Slug
yikes-inc-easy-mailchimp-extender
Published
2019-07-01
Title
Easy Forms for Mailchimp < 6.5.3 - Code Injection