Plugin vulnerabilities
Recently disclosed security vulnerabilities in WordPress plugins, newest first: what the issue is, which versions it hits, and the release that fixes it. The plugin directory itself never shows you any of this.
200 shown
- W Web 2.0 Directory plugin for WordPress Medium
Web 2.0 Directory <= 2.10.12 - Unauthenticated SQL Injection via 'w2dc_level_filter' Parameter
-
FlexStock <= 3.17.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via REST update endpoint
-
Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter
-
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal
-
Germanized for WooCommerce Medium Germanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Change
- W WooCommerce Extra Product Options Pro Medium
WooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' Parameter
-
Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint
-
WP Directory Kit High WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter
-
GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection
- B BuddyBoss Platform Medium
BuddyBoss Platform <= 3.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Name
-
All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter
-
Booking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parameter
-
SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data
-
Smart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter block
-
Newsletters Medium Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter
- F FeedWordPress High
FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content
-
Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter
-
WP Activity Log High WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting
-
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author term name
-
User Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameter
-
User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter
-
Content Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via RSS-linked article `<meta name="description">`
-
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker Critical Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
-
WP Data Access <= 5.5.88 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'rel_tab' Parameter
-
Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback
-
Uncanny Toolkit for LearnDash Critical Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter
-
Redux Framework Medium Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_name> JavaScript
-
Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint
-
WPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mail
-
WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden Medium WP2LEADS <= 3.5.6 - Authenticated (Subscriber+) SQL Injection via order Parameter
-
SEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Profile Field via %%archive_title%% Template Tag
-
Shield Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path (REQUEST_URI) in Traffic Log
-
Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement
-
Mail logging & Catcher <= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email Disclosure
-
FunnelKit Automations <= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameter
-
Discussion Board <= 2.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Profile Website (user_url) Field
-
WP Job Portal <= 2.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'degreetitle' Parameter
-
Hustle <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and sibling migrate_*) AJAX Action
-
PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest checkout
-
PDF Invoices & Packing Slips for WooCommerce <= 5.16.5 - Unauthenticated Sensitive Information Exposure via Yearly-Reset Invoice Attachment Cache
-
WP Booking System – Booking Calendar Critical WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action
-
Product Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter
-
Product Filter for WooCommerce by WBW <= 3.4.6 - Missing Authorization to Unauthenticated Information Disclosure via filterSettings[default_query] Parameter
-
Photo Reviews for WooCommerce <= 1.2.31 - Unauthenticated File Deletion via 'wcpr_image_upload_id' Parameter
-
Webmention Medium Webmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tag
-
W3 Total Cache Medium W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder
-
VikRentCar Car Rental Management System <= 1.4.10 - Unauthenticated Stored Cross-Site Scripting via 'optionals' Parameter
- W3 Total Cache High
W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry
-
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP Medium UsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash
-
User Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Splitting
-
VikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' Parameter
-
Welcart e-Commerce Medium Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter
- Welcart e-Commerce High
Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter
-
ThirstyAffiliates <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag
-
SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments
-
Seraphinite Accelerator Medium Seraphinite Accelerator <= 2.29.24 - Unauthenticated Sensitive Information Exposure in Object Cache Directory
-
Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter
-
Relevanssi <= 4.28.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decode
-
Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters
-
PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field
-
Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag
-
PPWP <= 1.9.26 - Unauthenticated Stored Cross-Site Scripting via '[ppwp]' Shortcode 'desc_below_form' Attribute via Placeholder Marker Collision
-
Ninja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name
-
Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization
-
Photo Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML
-
Meow Lightbox High Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization
-
Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload
-
Meow Gallery Medium Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)
-
Like Button Rating ♥ LikeBtn Medium Like Button Rating ♥ LikeBtn <= 2.6.64 - Unauthenticated Stored Cross-Site Scripting via 'Client-IP' Header
-
Majestic Support <= 1.2.2 - Authenticated (Subscriber+) SQL Injection via 'columns' Parameter
-
FV Flowplayer Video Player Medium FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments
-
GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter
- FV Flowplayer Video Player Medium
FV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes
- FV Flowplayer Video Player Medium
FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute
- I Independent Analytics Pro High
Independent Analytics Pro <= 2.15.5 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
-
Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter
-
Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter
-
CP Multi View Events Calendar <= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parameter
-
easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter
-
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Body
-
Ad Inserter <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter
-
GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter
-
JS Help Desk <= 5.0.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' Parameter
-
Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name
-
SEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title()
- Meow Gallery Medium
Meow Gallery <= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint
-
Themify Builder Medium Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field
-
Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture
-
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account Takeover
-
Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision
-
OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin <= 1.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure via PATCH /files/placements/<id> on orphaned placements
- Redux Framework Medium
Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id
-
Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection
-
Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion
-
Spectra Gutenberg Blocks <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page', 'path', and 'settings' GET Parameters
- A Ak Framework High
Ak Framework <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update
-
Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter
- G Gravity Forms High
Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values
- G Gravity Forms Critical
Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field
- G Gravity Forms High
Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field
-
Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookie
-
AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration
-
Page and Post Restriction Medium Page and Post Restriction <= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authentication
-
Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameter
-
Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter
-
Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX Action
-
Events Made Easy Medium Events Made Easy <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute
-
JoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute
-
Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata
-
Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field
-
NewsmanApp High NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters
- M MW WP Form Medium
MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter
-
Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys
-
NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header
-
Media Library Assistant Medium Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links
-
Mapster WP Maps High Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter
-
HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink
-
LiteSpeed Cache Medium LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization
- LiteSpeed Cache Medium
LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)
-
Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText
-
Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block
-
RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element
-
Extensions for Leaflet Map Medium Extensions for Leaflet Map <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property
-
Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter
-
Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})
-
JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute
-
Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys
-
Password Protected Medium Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler
-
Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter
-
DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption
-
Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie
-
SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter
-
Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter
-
Bot for Telegram on WooCommerce Critical Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token
-
SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover
-
Wild Apricot Login High Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite
-
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1037 - 1.7.1069 - Authenticated (Contributor+) Stored Cross-Site Scripting
2026-10-28 CVE-2026-107098 Affects 1.7.1037 - 1.7.1069 Patched in 1.7.1070 Full record on Wordfence ↗ -
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.3.71 - 1.7.1069 - Missing Authorization
-
Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP < 1.5.10 - Missing Authorization
-
Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload
-
Menu Cart for WooCommerce < 3.2.1 - Unauthenticated Stored Cross-Site Scripting
-
GoSMTP – SMTP for WordPress Medium GoSMTP – SMTP for WordPress < 1.2.5 - Authenticated (Custom Role+) Privilege Escalation
-
افزونه پیامک ووکامرس | Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected Cross-Site Scripting
-
Booking Package Medium Booking Package < 1.7.33 - Missing Authorization
-
Thrive Automator Medium Thrive Automator < 11.2 - Authenticated (Editor+) SQL Injection
-
Page Builder by SiteOrigin Medium Page Builder by SiteOrigin < 2.38.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
-
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.196 - Authenticated (Contributor+) Stored Cross-Site Scripting
-
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.196 - Authenticated (Contributor+) Stored Cross-Site Scripting
-
Court Reservation – Tennis, Padel & Sports Court Booking < 1.12.4 - Missing Authorization
-
Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.8.7 - Unauthenticated Information Exposure
-
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.9 - 5.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Welcart e-Commerce Medium
Welcart e-Commerce < 2.12.6 - Authenticated (Editor+) SQL Injection
-
PayPlug for WooCommerce (Official) 2.8.0 - 3.1.0 - Missing Authorization
-
Court Reservation – Tennis, Padel & Sports Court Booking < 1.12.4 - Missing Authorization
-
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.195 - Authenticated (Contributor+) Insecure Direct Object Reference
-
Copy Anything to Clipboard for WordPress – Copy Button, Copy Text & Copy Code < 5.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
-
PayPlug for WooCommerce (Official) 2.9.0 - 3.1.0 - Unauthenticated Insecure Direct Object Reference
-
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation < 2.0.2 - Unauthenticated Server-Side Request Forgery
-
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.3.81 - 1.7.1069 - Unauthenticated Information Exposure
-
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation < 2.0.2 - Authenticated (Administrator+) Remote Code Execution
-
Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP 1.4.38 - 1.5.9 - Missing Authorization
-
My auctions allegro Medium My auctions allegro <= 4.0.3 - Missing Authorization
-
Payconiq Medium Payconiq <= 1.0.4 - Unauthenticated Insecure Direct Object Reference
- Media Library Assistant Medium
Media Library Assistant < 3.42 - Cross-Site Request Forgery
-
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.3.68 - 1.7.1069 - Missing Authorization
-
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation < 2.0.2 - Authenticated (Administrator+) SQL Injection
- Page Builder by SiteOrigin Medium
Page Builder by SiteOrigin < 2.38.0 - Authenticated (Contributor+) Information Exposure
- Welcart e-Commerce Medium
Welcart e-Commerce < 2.12.6 - Missing Authorization
-
Recipe Card Blocks Lite Medium Recipe Card Blocks Lite 3.5.0 - 3.6.3 - Authenticated (Contributor+) SQL Injection
-
Echo Knowledge Base <= 17.214.0 - Reflected Cross-Site Scripting via 'new_kb_config' Parameter
-
Enable Media Replace Medium Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow
-
Contact Manager Critical Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass
-
Webheadcoder Multi-Step Forms for Contact Form 7 <= 4.7 - Reflected Cross-Site Scripting via 'l10n_print_after' Parameter
-
CMB2 Medium CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form
-
Prime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape
-
Awesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion
-
Postie Medium Postie <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink
-
If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' Attribute
-
VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task
-
AI ChatBot for WooCommerce <= 5.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via qcld_rag_manual_sync AJAX Action
-
The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload
-
WP Inventory Manager Medium WP Inventory Manager <= 2.5.5 - Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute
-
BeyondSEO <= 1.3.6 - Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalation
-
PayPal Brasil para WooCommerce <= 1.7.8 - Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Action
-
VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Attribute
-
Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title
-
VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) SQL Injection via 'catid' Block Attribute
-
Related Posts for WordPress Medium Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameter
-
Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter
- Related Posts for WordPress Medium
Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter
- A Avada (Fusion) Builder Medium
Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes
-
Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute
-
Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More Medium Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters
-
WP Visitor Statistics (Real Time Traffic) <= 8.8 - Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute
-
Product Addons for Woocommerce <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter
-
Rich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page
-
Waitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
-
Travelly <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes
-
UiChemy <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URL
-
Travelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter
Vulnerability records provided by Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. License and terms.
CVE records: Copyright 1999-2026 The MITRE Corporation. CVE terms of use.
Severity is the CVSS rating from the feed. "Affects" is the vulnerable version range; running a version in that range without the patched release means the hole is live on your site.