https://wordsec.net/vulnerabilities/plugins/wp-action-network/wordpress-action-network-143-authentcated-admin-sql-injection 2024-03-26T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/school-management/school-management-9200-unauthenticated-sql-injection 2025-06-11T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/zephyr-project-manager/zephyr-project-manager-33202-authenticated-admin-stored-cross-site-scripting 2025-09-25T17:41:11.000Z https://wordsec.net/vulnerabilities/plugins/woo-binary-mlm/binary-mlm-woocommerce-20-reflected-cross-site-scripting-via-page 2025-01-06T16:22:39.000Z https://wordsec.net/vulnerabilities/plugins/wordfence/wordfence-523-stored-cross-site-scripting-via-request_uri 2014-09-14T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/dokan-lite/dokan-ai-powered-woocommerce-multivendor-marketplace-solution-build-your-own-amazon-ebay-etsy-5010-missing-authorization 2026-07-29T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/simple-file-list/simple-file-list-324-arbitrary-file-deletion 2019-05-23T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/cf7-styler/cf7-wow-styler-172-unauthenticated-local-file-inclusion 2025-08-07T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/yith-woocommerce-compare/yith-woocommerce-compare-209-unauthenticated-php-object-injection 2016-11-08T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/forms-3rdparty-post-again/forms-3rd-party-post-again-03-reflected-cross-site-scripting 2024-11-04T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/fv-wordpress-flowplayer/fv-player-75577211-unauthenticated-stored-cross-site-scripting 2026-11-05T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/gtranslate/gtranslate-2851-reflected-cross-site-scripting 2020-04-20T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/hungarian-pickup-points-for-woocommerce/csomagpontok-s-cmkk-woocommerce-hez-428-missing-authorization 2026-09-07T13:35:35.000Z https://wordsec.net/vulnerabilities/plugins/media-file-organizer/media-file-organizer-101-directory-traversal 2021-04-13T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/sequel/sequel-1011-reflected-cross-site-scripting 2025-04-02T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wp-rss-multi-importer/wp-rss-multi-importer-314-cross-site-request-forgery 2014-09-17T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/locations/locations-40-authenticated-contributor-stored-cross-site-scripting 2023-09-05T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/minify-html-markup/minify-html-2112-cross-site-request-forgery-to-plugin-settings-update 2026-03-30T23:01:56.000Z https://wordsec.net/vulnerabilities/plugins/auxin-elements/shortcodes-and-extra-features-for-phlox-theme-2157-authenticated-contributor-stored-cross-site-scripting-via-aux_timeline-shortcode 2024-04-15T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/course-booking-system/course-booking-system-612-reflected-cross-site-scripting 2025-04-14T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/events-manager/events-manager-740-authenticated-contributor-sql-injection-via-meta_key-parameter-in-eventlocation-duplicate-action 2026-08-24T13:24:31.000Z https://wordsec.net/vulnerabilities/plugins/wp-timelines/wp-timeline-vertical-and-horizontal-timeline-plugin-367-authenticated-contributor-local-file-inclusion 2024-09-25T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wp-dummy-content-generator/wp-dummy-content-generator-400-missing-authorization 2026-10-05T10:21:00.000Z https://wordsec.net/vulnerabilities/plugins/participants-database/participants-database-2785-unauthenticated-php-object-injection 2026-10-21T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wp2wb/wordpres-110-cross-site-request-forgery 2025-03-24T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/the-events-calendar/the-events-calendar-6120-6175-unauthenticated-arbitrary-shortcode-execution 2026-09-28T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/powerpress/powerpress-podcasting-11126-authenticated-contributor-server-side-request-forgery 2025-04-09T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/click-to-chat-for-whatsapp/click-to-chat-holithemes-335-authenticated-contributor-local-file-inclusion 2024-04-17T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/expresstechsoftwares-memberpress-discord-add-on/memberpress-discord-addon-114-reflected-cross-site-scripting 2026-01-20T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wp-lightbox-2/wp-lightbox-2-3066-authenticated-contributor-dom-based-stored-cross-site-scripting 2024-07-02T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/usc-e-shop/welcart-e-commerce-21124-missing-authorization 2025-10-14T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/users-ultra/users-ultra-membership-users-community-and-member-profiles-with-paypal-integration-plugin-1563-cross-site-scripting 2015-12-02T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/powerpack-lite-for-elementor/powerpack-addons-for-elementor-free-widgets-extensions-and-templates-2713-cross-site-request-forgery 2024-01-02T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/mystickymenu/my-sticky-bar-formerly-mystickymenu-271-authenticated-admin-stored-cross-site-scripting 2024-07-11T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/the-events-calendar/the-events-calendar-61121-missing-authorization 2025-05-19T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/usc-e-shop/welcart-e-commerce-21116-authenticated-editor-stored-cross-site-scripting 2025-07-16T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/codeconfig-accessibility/accessiy-by-codeconfig-accessibility-100-missing-authorization-to-authenticated-subscriber-arbitrary-page-creation 2025-12-05T17:47:37.000Z https://wordsec.net/vulnerabilities/plugins/wp-lister-for-ebay/wp-lister-lite-for-ebay-389-unauthenticated-stored-cross-site-scripting-via-ajax-cron-handler-request 2026-09-15T15:28:11.000Z https://wordsec.net/vulnerabilities/plugins/user-registration/user-registration-membership-522-unauthenticated-privilege-escalation 2026-06-26T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/mstore-api/mstore-api-create-native-android-ios-apps-on-the-cloud-4153-authenticated-subscriber-limited-arbitrary-file-upload 2024-09-12T20:50:39.000Z https://wordsec.net/vulnerabilities/plugins/getwid/getwid-gutenberg-blocks-2010-missing-authorization-to-google-api-key-update 2024-07-19T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/newstatpress/newstatpress-145-unauthenticated-stored-cross-site-scripting-via-url-request-tracking-urlrequested-field 2026-10-13T15:38:02.000Z https://wordsec.net/vulnerabilities/plugins/booking-system/pinpoint-booking-system-29947-authenticated-admin-stored-cross-site-scripting 2024-07-15T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/translatepress-multilingual/translatepress-2102-unauthenticated-php-object-injection 2025-09-24T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/greenshift-animation-and-page-builder-blocks/greenshift-animation-and-page-builder-blocks-900-missing-authorization-to-authenticated-subscriber-server-side-request-forgery-and-stored-cross-site-scripting 2025-01-08T22:19:00.000Z https://wordsec.net/vulnerabilities/plugins/webinfos/webinfos-12-unauthenticated-arbitrary-file-upload 2026-08-06T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/lana-email-tester/lana-email-tester-100-missing-authorization-to-mail-relay-cross-site-request-forgery 2022-06-15T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/bookify/bookify-appointment-booking-scheduling-for-wordpress-111-missing-authorization 2026-04-23T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/north-plugin/north-142-authenticated-contributor-local-file-inclusion 2025-11-03T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/specia-companion/specia-companion-48-missing-authorization 2025-04-07T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/uji-countdown/uji-countdown-23-authenticated-admin-stored-cross-site-scripting 2022-11-10T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/magic-edge-lite-image-background-remover/magic-edge-lite-116-authenticated-contributor-stored-cross-site-scripting-via-height-parameter 2025-08-01T19:37:23.000Z https://wordsec.net/vulnerabilities/plugins/b-blocks/bblocks-essential-gutenberg-blocks-patterns-collection-2115-authenticated-contributor-stored-cross-site-scripting 2026-11-11T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/weichuncai/weichuncaiwp-15-cross-site-request-forgery-to-stored-cross-site-scripting 2025-08-15T14:45:37.000Z https://wordsec.net/vulnerabilities/plugins/telegram-bot/telegram-bot-channel-41-unauthenticated-stored-cross-site-scripting-via-telegram-username 2025-11-24T16:29:12.000Z https://wordsec.net/vulnerabilities/plugins/master-addons/master-addons-for-elementor-elementor-addons-widgets-mega-menu-builder-popup-builder-widget-builder-template-kits-322-missing-authorization 2026-09-11T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/easy-post-submission/easy-post-submission-170-unauthenticated-sensitive-information-exposure 2025-10-16T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wp-stripe-checkout/wp-stripe-checkout-12241-authenticated-contributor-stored-cross-site-scripting-via-shortcode 2024-04-16T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/skt-blocks/skt-blocks-17-authenticated-contributor-stored-cross-site-scripting 2025-02-14T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/audioigniter/audioigniter-music-player-202-unauthenticated-insecure-direct-object-reference-to-audioigniter_playlist_id-parameter 2026-05-21T19:33:26.000Z https://wordsec.net/vulnerabilities/plugins/basepress/knowledge-base-documentation-wiki-plugin-basepress-21701-authenticated-contributor-stored-cross-site-scripting 2025-12-31T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/dt-lms-lite/dt-lms-11-missing-authorization-to-unauthenticated-arbitrary-plugin-settings-modification-via-multiple-ajax-actions 2026-09-11T18:48:09.000Z https://wordsec.net/vulnerabilities/plugins/causes/causes-donation-plugin-1001-reflected-cross-site-scripting 2025-01-16T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/daggerhart-openid-connect-generic/openid-connect-generic-client-3100-authenticated-contributor-stored-cross-site-scripting-via-shortcode 2025-12-17T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/chaty-pro/chaty-pro-358-unauthenticated-stored-cross-site-scripting 2026-08-17T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/date-counter/date-counter-203-authenticated-contributor-stored-cross-site-scripting 2025-10-11T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/multi-step-form/multi-step-form-125-stored-cross-site-scripting 2018-07-27T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/ht-mega-for-elementor/ht-mega-addons-for-elementor-327-unauthenticated-stored-dom-based-cross-site-scripting-via-tabs-widget-href-dom-sink 2026-10-28T21:11:54.000Z https://wordsec.net/vulnerabilities/plugins/kb-support/kb-support-167-unauthenticated-open-redirect 2025-01-24T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/cost-calculator-builder/cost-calculator-builder-401-unauthenticated-price-manipulation-and-insecure-direct-object-reference 2026-05-12T15:19:44.000Z https://wordsec.net/vulnerabilities/plugins/simple-gmail-login/simple-gmail-login-114-sensitive-information-disclosure 2012-11-24T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/woo-thank-you-page-customizer/thanko-thank-you-page-customizer-for-woocommerce-increase-your-sales-122-missing-authorization 2026-09-08T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/confetti-fall-animation/confetti-fall-animation-130-authenticated-contributor-stored-cross-site-scripting 2024-09-30T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/translatepress-multilingual/translatepress-translate-multilingual-sites-with-ai-translation-332-unauthenticated-privilege-escalation 2026-08-24T12:35:49.000Z https://wordsec.net/vulnerabilities/plugins/pricing-table/pricing-table-152-authenticated-author-stored-cross-site-scripting 2022-04-05T14:36:00.000Z https://wordsec.net/vulnerabilities/plugins/unilevel-mlm-plan/unilevel-mlm-plan-110-reflected-cross-site-scripting-via-page 2025-01-06T15:43:18.000Z https://wordsec.net/vulnerabilities/plugins/seo-help/seo-help-685-missing-authorization 2025-04-07T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/taxonomy-terms-order/category-order-and-taxonomy-terms-order-1522-authenticated-php-object-injection 2018-02-22T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wpdevart-vertical-menu/responsive-vertical-icon-menu-158-cross-site-request-forgery 2023-01-20T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/woo-vipps/pay-with-vipps-and-mobilepay-for-woocommerce-500-640-fill-this-out 2026-11-04T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/utilities-for-mtg/utilities-for-mtg-141-authenticated-contributor-stored-cross-site-scripting 2025-01-17T19:01:19.000Z https://wordsec.net/vulnerabilities/plugins/url-shortify/url-shortify-simple-powerful-and-easy-url-shortener-plugin-for-wordpress-165-authenticated-admin-stored-cross-site-scripting 2023-06-19T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/social-pug/hubbub-lite-1360-reflected-cross-site-scripting 2025-11-05T18:42:05.000Z https://wordsec.net/vulnerabilities/plugins/gb-forms-db/gb-forms-db-102-unauthenticated-remote-code-execution 2025-07-10T18:32:31.000Z https://wordsec.net/vulnerabilities/plugins/wp-staging/wp-staging-wordpress-backup-plugin-320-sensitive-information-exposure-via-cache-files 2024-01-31T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/form-block/form-block-181-unauthenticated-stored-cross-site-scripting 2026-10-05T10:12:12.000Z https://wordsec.net/vulnerabilities/plugins/smart-wishlist-for-more-convert-premium/moreconvert-pro-1914-authentication-bypass-via-waitlist-guest-verification-token-reuse 2026-05-04T13:18:12.000Z https://wordsec.net/vulnerabilities/plugins/axle-demo-importer/axle-demo-importer-103-authenticated-author-arbitrary-file-upload 2025-06-11T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/ultimate-addons-for-contact-form-7/ultra-addons-for-contact-form-7-3550-authenticated-contributor-stored-cross-site-scripting 2026-09-22T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/adminonline/adminonline-unspecified-version-directly-traversalarbitrary-file-read 2014-06-11T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/s3bubble-amazon-s3-html-5-video-with-adverts/s3-bubble-amazon-s3-html5-video-with-adverts-20-arbitrary-file-download 2015-04-07T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/webtoffee-product-feed/product-feed-for-woocommerce-228-missing-authorization 2025-06-05T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wpsynchro/wp-migration-plugin-db-files-wp-synchro-1112-cross-site-request-forgery 2024-04-11T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wp-tiktok-feed/quadlayers-tiktok-feed-464-missing-authorization 2025-12-31T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/one-click-demo-import/catch-themes-demo-import-302-authenticated-admin-arbitrary-file-upload 2022-04-11T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/calendar/calendar-132-cross-site-request-forgery 2014-08-01T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/ink-official/ink-official-412-authenticated-contributor-arbitrary-file-upload 2024-10-21T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wp-image-uploader/wp-image-uploader-101-reflected-cross-site-scripting 2025-01-29T23:03:02.000Z https://wordsec.net/vulnerabilities/plugins/jsp-store-locator/jsp-store-locator-10-cross-site-request-forgery-to-store-deletion 2024-12-27T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/gmap-embed/maps-plugin-using-google-maps-for-wordpress-wp-google-map-193-authenticated-admin-stored-cross-site-scripting 2025-01-24T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wpforo/wpforo-forum-1412-sql-injection 2018-05-27T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/mastercurrency-wp/master-currency-wp-1161-authenticated-contributor-stored-cross-site-scripting-via-currency-converter-form-shortcode 2024-07-26T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/ai-copilot-content-generator/ai-copilot-content-generator-156-unauthenticated-privilege-escalation 2026-07-28T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/porto-functionality/porto-theme-functionality-310-authenticated-contributor-local-file-inclusion-via-shortcode 2024-05-08T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/shipdeo-woo/shipdeo-128-reflected-cross-site-scripting 2025-01-16T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/easy-social-icons/easy-social-icons-1231-sql-injection 2015-07-22T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/spider-elements/spider-elements-addons-for-elementor-165-authenticated-contributor-stored-cross-site-scripting 2025-04-04T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/download-manager/download-manager-3238-unauthenticated-brute-force-of-file-master-key 2022-03-16T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/elementinvader-addons-for-elementor/elementinvader-addons-for-elementor-142-authenticated-subscriber-sql-injection 2026-03-23T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/full-screen-menu-for-elementor/full-screen-menu-for-elementor-107-authenticated-contributor-post-disclosure 2024-12-20T20:18:51.000Z https://wordsec.net/vulnerabilities/plugins/wp-analytify/analytify-551-missing-authorization-to-authenticated-subscriber-minor-settings-update 2025-03-27T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wp-timed-popup/timed-popup-wordpress-plugin-14-cross-site-request-forgery 2014-12-12T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/drop-caps/drop-caps-21-cross-site-request-forgery-to-stored-cross-site-scripting 2025-04-24T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/xml-sitemaps-for-videos/google-xml-sitemap-for-videos-261-cross-site-request-forgery-via-video_sitemap_generate 2023-03-15T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/definitive-addons-for-elementor/definitive-addons-for-elementor-1516-authenticated-contributor-stored-cross-site-scripting 2024-10-31T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/one-click-close-comments/one-click-close-comments-271-unauthenticated-full-path-disclosure 2024-07-26T13:12:00.000Z https://wordsec.net/vulnerabilities/plugins/download-manager/download-manager-3303-improper-authorization-to-unauthenticated-download-of-password-protected-files 2024-12-18T16:22:49.000Z https://wordsec.net/vulnerabilities/plugins/w4-post-list/w4-post-list-244-authenticated-contributor-stored-cross-site-scripting-via-w4plno_items_text 2023-03-08T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/kubio/kubio-ai-page-builder-285-missing-authorization-to-authenticated-contributor-front-pagemenutemplate-configuration-reversion-via-kubio_restore_front_page-ajax-action 2026-08-15T15:33:07.000Z https://wordsec.net/vulnerabilities/plugins/wp-invoice/wp-invoice-431-authenticated-subscriber-information-exposure 2026-10-09T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/poll-maker/poll-maker-best-wordpress-poll-plugin-518-missing-authorization-to-unauthenticated-stored-cross-site-scripting 2024-04-18T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/better-follow-button-for-jetpack/better-follow-button-for-jetpack-80-authenticated-admin-stored-cross-site-scripting 2024-01-23T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/translatepress-multilingual/translatepress-translate-multilingual-sites-with-ai-translation-325-unauthenticated-stored-cross-site-scripting 2026-08-18T18:23:24.000Z https://wordsec.net/vulnerabilities/plugins/job-manager/job-manager-0725-insecure-direct-object-reference 2015-08-28T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/broken-link-manager/broken-link-manager-065-reflected-cross-site-scripting 2025-11-03T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/real3d-flipbook-lite/real3d-flipbook-3d-flipbook-pdf-flipbook-pdf-viewer-pdf-embedder-55-unauthenticated-stored-cross-site-scripting 2026-10-05T15:05:34.000Z https://wordsec.net/vulnerabilities/plugins/arrow-twitter-feed/arrow-custom-feed-for-twitter-153-authenticated-contributor-stored-cross-site-scripting 2025-04-01T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/admin-site-enhancements/admin-and-site-enhancements-797-authenticated-author-stored-cross-site-scripting-via-svg 2025-09-01T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/googl-url-shorter/googl-url-shorter-101-reflected-cross-site-scripting 2025-01-16T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/woo-smart-quick-view/wpc-smart-quick-view-for-woocommerce-440-reflected-cross-site-scripting-via-woosq-redirect-parameter 2026-10-02T17:20:40.000Z https://wordsec.net/vulnerabilities/plugins/calderawp-license-manager/calderawp-license-manager-1211-cross-site-request-forgery 2022-04-12T10:56:00.000Z https://wordsec.net/vulnerabilities/plugins/oembed-gist/oembed-gist-491-authenticated-contributor-stored-cross-site-scripting 2024-01-03T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/rt18-extensions/rt-theme-18-responsive-wordpress-theme-25-reflected-cross-site-scripting 2026-07-06T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/animated-number-counters/animated-number-counters-30-authenticated-editor-sql-injection-via-counterid-parameter 2026-10-12T19:05:41.000Z https://wordsec.net/vulnerabilities/plugins/http-headers/http-headers-11811-authenticated-administrator-stored-cross-site-scripting 2023-07-10T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/clubmember/clubmember-02-authenticated-admin-stored-cross-site-scripting 2025-11-03T15:51:37.000Z https://wordsec.net/vulnerabilities/plugins/instant-appointment/instant-appointment-12-unauthenticated-sql-injection 2024-12-12T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/google-1/peadigs-google-1-button-012-authenticated-contributor-stored-cross-site-scripting 2025-04-24T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wp-simple-sitemap/wp-simple-sitemap-02-cross-site-request-forgery-to-stored-cross-site-scripting 2025-01-03T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/auto-limit-posts-reloaded/auto-limit-posts-reloaded-25-cross-site-request-forgery 2023-10-26T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/mb-custom-post-type/mb-custom-post-types-custom-taxonomies-240-2122-missing-authorization 2026-10-20T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/post-and-page-builder/post-and-page-builder-by-boldgrid-visual-drag-and-drop-editor-1278-authenticated-contributor-path-traversal 2025-07-22T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/bulk-page-creator/bulk-page-creator-113-cross-site-request-forgery-to-arbitrary-page-creation 2022-05-09T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wordpress-seo/yoast-seo-2711-authenticated-contributor-stored-cross-site-scripting-via-jsontext-block-attribute 2026-03-21T14:57:12.000Z https://wordsec.net/vulnerabilities/plugins/nexi-xpay-build/nexi-xpay-build-722-762-unauthenticated-payment-bypass 2026-10-05T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/http-https-remover/inisev-analyst-module-various-versions-missing-authorization 2024-04-10T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/custom-registration-form-builder-with-submission-manager/registrationmagic-5192-improper-authorization-to-price-change 2023-01-20T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/anycomment/anycomment-0217-cross-site-request-forgery 2022-01-19T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/post-grid/post-grid-combo-36-gutenberg-blocks-2268-information-exposure-via-get_posts-api-endpoint 2024-03-12T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wpmuldap/wpmu-ldap-authentication-501-cross-site-request-forgery-to-stored-cross-site-scripting 2025-08-21T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/jc-importer/import-wp-export-and-import-csv-and-xml-files-to-wordpress-21423-unauthenticated-information-exposure 2026-08-14T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/gym-management/wpgym-wordpress-gym-management-system-unknown-version-sql-injection 2017-09-26T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/the-plus-addons-for-elementor-page-builder/the-plus-addons-for-elementor-6315-authenticated-author-stored-cross-site-scripting-via-svg 2025-09-22T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/easy-admin-menu/easy-admin-menu-13-authenticated-administrator-stored-cross-site-scripting 2023-05-23T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/ngg-smart-image-search/ngg-smart-image-search-333-authenticated-contributor-stored-cross-site-scripting 2025-05-07T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/link-library/link-library-7513-cross-site-request-forgery-via-action_admin_init 2024-02-05T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/ai-engine/ai-engine-365-authenticated-subscriber-arbitrary-file-read 2026-08-03T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/ezoic-integration/ezoic-22211-authentication-bypass 2026-08-14T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/buddyforms/frontend-content-forms-for-user-submissions-ugc-2815-authenticated-contributor-stored-cross-site-scripting-via-buddyforms_nav-shortcode 2025-02-21T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/playerzbr/playerzbr-16-authenticated-contributor-stored-cross-site-scripting-via-url-meta-field 2025-10-21T20:18:00.000Z https://wordsec.net/vulnerabilities/plugins/norse-runes-oracle/norse-rune-oracle-plugin-142-cross-site-request-forgery-to-stored-cross-site-scripting 2025-01-07T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wp-donimedia-carousel/wp-donimedia-carousel-101-authenticated-subscriber-arbitrary-file-upload 2024-10-28T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/addons-for-visual-composer/wpbakery-page-builder-addons-by-livemesh-394-missing-authorization-to-authenticated-subscriber-stored-cross-site-scripting 2026-05-26T17:33:39.000Z https://wordsec.net/vulnerabilities/plugins/addons-for-elementor/livemesh-addons-for-elementor-90-authenticated-contributor-stored-cross-site-scripting 2026-02-13T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/gs-woocommerce-products-slider/gs-products-slider-for-woocommerce-158-authenticated-contributor-stored-cross-site-scripting-via-shortcode 2023-01-30T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/rs-wp-books-showcase/rs-wp-book-showcase-6740-authenticated-contributor-stored-cross-site-scripting 2025-05-07T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/football-pool/football-pool-2113-authenticated-contributor-stored-cross-site-scripting 2024-01-08T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/auto-load-next-post/auto-load-next-post-1514-cross-site-request-forgery 2025-03-24T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/multiple-votes-in-one-page/multiple-votes-in-one-page-104-authenticated-contributor-stored-cross-site-scripting 2024-11-08T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/participants-database/participants-database-2783-missing-authorization-to-unauthenticated-arbitrary-record-update-sensitive-information-exposure-via-id-parameter 2026-07-23T14:30:26.000Z https://wordsec.net/vulnerabilities/plugins/arconix-faq/arconix-faq-195-reflected-cross-site-scripting 2025-04-10T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/gdpr-compliant-recaptcha-for-all-forms/invisible-anti-spam-captcha-51-unauthenticated-stored-cross-site-scripting-via-action-parameter 2026-08-14T15:08:15.000Z https://wordsec.net/vulnerabilities/plugins/wp-clone-any-post-type/wp-clone-any-post-type-36-missing-authorization 2025-04-01T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/school-management/school-management-9150-unauthenticated-arbitrary-file-upload 2024-11-22T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/usc-e-shop/welcart-e-commerce-21122-authenticated-editor-stored-cross-site-scripting-via-order_mail 2025-10-21T17:22:23.000Z https://wordsec.net/vulnerabilities/plugins/woocommerce-box-office/woocommerce-box-office-122-missing-authorization 2024-01-31T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wp-affiliate-platform/wp-affiliate-platform-651-cross-site-request-forgery-to-stored-cross-site-scripting 2024-06-22T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/simple-file-list/simple-file-list-327-arbitrary-file-download 2019-05-23T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/media-library-organizer/media-library-organizer-204-213-missing-authorization 2026-09-28T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/gtranslate/translate-wordpress-with-gtranslate-298-translate-wordpress-google-language-translator-6013-missing-authorization-to-sensitive-information-disclosure 2022-03-07T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/visual-recent-posts/visual-recent-posts-123-reflected-cross-site-scripting 2024-12-12T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/calendar/calendar-138-reflected-cross-site-scripting 2016-11-08T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/jet-popup/jetpopup-2011-missing-authorization 2025-04-15T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/bus-ticket-booking-with-seat-reservation/bus-ticket-booking-with-seat-reservation-523-reflected-cross-site-scripting 2023-08-01T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/free-comments-for-wordpress-vuukle/vuukle-comments-reactions-share-bar-revenue-3431-cross-site-request-forgery-bypass 2021-07-05T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/formidable/formidable-forms-67-html-injection 2024-01-08T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/cm-pop-up-banners/cm-pop-up-banners-1510-authenticated-subscriber-sql-injection-via-getstatistics 2023-05-03T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/synved-shortcodes/wordpress-shortcodes-1636-authenticated-contributor-stored-cross-site-scripting-via-shortcode 2023-02-13T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/darkmysite/darkmysite-advanced-dark-mode-plugin-for-wordpress-128-cross-site-request-forgery 2024-10-24T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/forms-signature-formidable-online-contract-automation/formidable-forms-signature-online-contract-automation-201-unauthenticated-insecure-direct-object-reference 2026-07-28T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/ultimate-blocks/ultimate-blocks-330-authenticated-contributor-stored-cross-site-scripting 2025-05-19T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/userpro/userpro-4920-privilege-escalation 2019-01-03T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/post-grid-carousel-ultimate/post-grid-slider-carousel-ultimate-with-shortcode-gutenberg-block-elementor-widget-1610-authenticated-contributor-local-file-inclusion 2025-01-23T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/xili-dictionary/xili-dictionary-2125-reflected-cross-site-scripting 2025-03-27T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/optimate-ads/optimate-ads-103-authenticated-subscriber-stored-cross-site-scripting 2025-02-03T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/mainwp-child-reports/mainwp-child-reports-207-admin-sql-injection 2021-09-20T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/radius-blocks/radius-blocks-221-authenticated-contributor-stored-cross-site-scripting-via-subheadingtagname-parameter 2025-08-14T20:13:25.000Z https://wordsec.net/vulnerabilities/plugins/optional-email/optional-email-1311-unauthenticated-privilege-escalation-to-account-takeover 2026-01-06T19:57:29.000Z https://wordsec.net/vulnerabilities/plugins/geo-mashup/geo-mashup-11312-authenticated-contributor-stored-cross-site-scripting 2024-09-16T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/ai-wp-writer/ai-wp-writer-3844-cross-site-request-forgery 2025-01-06T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wp-event-solution/eventin-event-calendar-tickets-registration-booking-woocommerce-4123-authenticated-subscriber-privilege-escalation-via-map_meta_cap-filter 2026-09-14T17:13:14.000Z https://wordsec.net/vulnerabilities/plugins/elementskit-lite/elementskit-lite-303-unauthenticated-sensitive-information-exposure 2024-01-08T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/gamipress/gamipress-256-cross-site-request-forgery-to-user-earnings-deletion 2023-02-14T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/rt-mega-menu/rt-mega-menu-mega-menu-builder-for-elementor-gutenberg-151-authenticated-subscriber-stored-cross-site-scripting 2026-07-27T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/paid-member-subscriptions/paid-member-subscriptions-2151-unauthenticated-sql-injection 2025-07-03T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wp-google-places-review-slider/wp-google-review-slider-155-authenticated-admin-stored-cross-site-scripting 2025-03-03T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/ulisting/ulisting-166-unauthenticated-options-changes-via-wp_route 2021-01-28T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/taxonomy-discounts-woocommerce/taxonomyterm-and-role-based-discounts-for-woocommerce-51-cross-site-request-forgery-to-settings-update 2025-01-24T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/email-subscribers/email-subscribers-newsletters-422-unauthenticated-option-creation 2019-11-13T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/accordions-wp/accordion-26-authenticated-editor-stored-cross-site-scripting-via-accordion-settings 2023-11-15T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/hospital-doctor-directory/hospital-doctor-directory-139-authenticated-subscriber-privilege-escalation 2026-01-22T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/shareaholic/shareaholic-978-authenticated-contributor-stored-cross-site-scripting-via-shortcode 2023-11-14T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/advanced-popups/advanced-popups-123-authenticated-author-stored-cross-site-scripting-via-notification-button-link-field 2026-09-15T15:27:04.000Z https://wordsec.net/vulnerabilities/plugins/masterstudy-lms-learning-management-system/masterstudy-lms-wordpress-plugin-for-online-courses-and-education-3730-missing-authorization 2026-06-26T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wp-download-codes/wp-download-codes-254-reflected-cross-site-scripting 2025-01-16T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/browser-and-operating-system-finder/browser-and-operating-system-finder-12-missing-authorization 2022-06-02T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/if-menu/if-menu-0191-missing-authorization-to-license-key-update 2024-12-06T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wp-3dflick-slideshow/3d-flick-slideshow-22-arbitrary-file-upload 2012-06-01T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/googmonify/googmonify-051-cross-site-request-forgery-to-cross-site-scripting 2015-08-23T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/order-delivery-date-for-woocommerce/order-delivery-date-for-woocommerce-3210-cross-site-request-forgery-to-notice-dismissal 2024-04-12T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/yith-slider-for-page-builders/yith-slider-for-page-builders-1011-missing-authorization 2025-12-24T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/falcon/falcon-wordpress-optimizations-tweaks-2100-missing-authorization 2026-07-23T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/auto-youtube-importer/auto-youtube-importer-103-cross-site-request-forgery 2023-02-03T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/social-testimonials-and-reviews-widget/social-proof-testimonials-and-reviews-by-repuso-520-authenticated-contributor-stored-cross-site-scripting 2025-01-14T21:08:00.000Z https://wordsec.net/vulnerabilities/plugins/m1downloadlist/m1downloadlist-019-authenticated-contributor-stored-cross-site-scripting 2025-03-03T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/badgearoo/badgearoo-1014-reflected-cross-site-scripting 2025-02-14T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/fv-wordpress-flowplayer/fv-player-75567211-authenticated-contributor-server-side-request-forgery 2026-11-02T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/yop-poll/yop-poll-642-ip-spoofing-via-x-forwarded-for-header 2022-07-11T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/woocommerce-shipping-canada-post/woocommerce-canada-post-shipping-283-cross-site-request-forgery 2023-11-14T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/real-time-validation-for-gravity-forms/real-time-validation-for-gravity-forms-170-unauthenticated-local-file-inclusion 2025-05-30T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/acf-link-picker-field/advanced-custom-fields-link-picker-field-128-reflected-cross-site-scripting 2025-04-11T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/enteraddons/enter-addons-ultimate-template-builder-for-elementor-219-authenticated-contributor-post-disclosure 2024-11-22T15:09:31.000Z https://wordsec.net/vulnerabilities/plugins/demo-importer-plus/demo-importer-plus-208-missing-authorization-to-authenticated-subscriber-site-reset-and-privilege-escalation 2025-12-17T21:19:54.000Z https://wordsec.net/vulnerabilities/plugins/easy-table-of-contents/easy-table-of-contents-20452-missing-authorization-via-eztoc_reset_options_to_default 2023-03-21T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/happyforms/happyforms-1259-reflected-cross-site-scripting 2023-11-27T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/recipe-card-blocks-by-wpzoom/recipe-card-blocks-by-wpzoom-280-reflected-cross-site-scripting 2021-08-24T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/easy-testimonials/easy-testimonials-1361-authenticated-stored-cross-site-scripting 2016-07-31T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wp-event-manager/event-manager-341-authenticated-subscriber-insecure-direct-object-reference 2026-11-02T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/bookingpress-appointment-booking/bookingpress-1011-sql-injection 2022-02-28T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/siteimprove/siteimprove-206-cross-site-request-forgery 2024-04-11T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/tablepress/tablepress-242-authenticated-author-stored-cross-site-scripting 2024-10-11T20:34:39.000Z https://wordsec.net/vulnerabilities/plugins/download-manager/download-manager-3324-cross-site-request-forgery 2025-09-26T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/count-per-day/count-per-day-355-unauthenticated-stored-cross-site-scripting 2016-08-05T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/popup-more/popup-more-popups-232-authenticated-administrator-stored-cross-site-scripting 2024-05-14T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/woocommerce-one-page-checkout/woocommerce-one-page-checkout-230-authenticated-contributor-local-file-inclusion-via-woocommerce_one_page_checkout 2023-08-10T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/ays-popup-box/popup-box-412-cross-site-request-forgery 2024-05-03T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/fileorganizer/fileorganizer-and-fileorganizer-pro-106-authenticated-stored-cross-site-scripting 2024-04-23T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/logmytrip/logmytrip-19-unauthenticated-sql-injection 2026-07-24T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/site-is-offline-plugin/site-offline-or-coming-soon-166-cross-site-request-forgery-to-settings-update-and-cross-site-scripting 2022-06-06T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/relevanssi-premium/relevanssi-4245-free-and-2276-premium-unauthenticated-stored-cross-site-scripting-via-excerpt-highlights 2025-05-30T14:49:18.000Z https://wordsec.net/vulnerabilities/plugins/final-tiles-grid-gallery-lite/image-photo-gallery-final-tiles-grid-3616-authenticated-contributor-stored-cross-site-scripting 2026-10-14T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/accelerated-mobile-pages/amp-for-wp-10931-authenticatedcontributor-arbitrary-post-deletion-via-amppb_remove_saved_layout_data 2024-02-06T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/woocommerce-products-filter/husky-products-filter-professional-for-woocommerce-1364-unauthenticated-local-file-inclusion 2025-03-14T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/awesome-support/awesome-support-616-insufficient-authorization-via-wpas_can_delete_attachments 2024-03-12T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/infility-global/infility-global-2127-authenticated-subscriber-sql-injection 2025-05-29T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/css-hero/css-hero-403-reflected-cross-site-scripting 2019-12-02T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/participants-database/participants-database-2763-authenticated-contributor-stored-cross-site-scripting 2025-09-22T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/simple-buttons-creator/simple-buttons-creator-104-unauthenticated-stored-cross-site-scripting-via-add-button 2024-03-25T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/exchange-addon-custom-url-tracking/exchange-addon-custom-url-tracking-110-reflected-cross-site-scripting 2015-04-20T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/joomsport-sports-league-results-management/joomsport-579-authenticated-administrator-sql-injection-via-order-parameter 2026-08-04T18:43:21.000Z https://wordsec.net/vulnerabilities/plugins/news-kit-elementor-addons/news-kit-elementor-addons-121-authenticated-contributor-sensitive-information-exposure-via-canvas-menu-elementor-template 2024-10-21T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/s2member/s2member-pro-241114-unauthenticated-remote-code-execution 2024-12-02T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/bus-ticket-booking-with-seat-reservation/bus-ticket-booking-with-seat-reservation-535-authenticated-administrator-stored-cross-site-scripting 2024-08-28T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/sola-newsletters/nifty-newsletters-4023-cross-site-request-forgery-to-stored-cross-site-scripting 2021-07-31T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/gf-constant-contact/gravity-forms-constant-contact-112-unauthenticated-php-object-injection 2025-08-08T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/sitemap/sitemap-43-authenticated-contributor-stored-cross-site-scripting-via-shortcode 2022-12-27T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/seo-booster/seo-booster-731-authenticated-administrator-sql-injection-via-sort_field-parameter 2026-07-15T15:20:07.000Z https://wordsec.net/vulnerabilities/plugins/wp_roknewspager/roknewspager-117-path-disclosure 2013-09-17T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/generateblocks/generateblocks-135-authenticated-contributor-stored-cross-site-scripting 2021-11-01T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/mapsvg/mapsvg-8613-authenticated-contributor-privilege-esclation 2025-06-09T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wp-icommerce/wp-icommerce-the-first-interactive-ecommerce-for-wordpress-111-authenticated-admin-sql-injection 2021-08-22T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/woo-social-login/woocommerce-social-login-262-unauthenticated-php-object-injection 2024-06-14T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wp-product-feed-manager/woocommerce-google-feed-manager-280-missing-authorization-to-authenticated-contributor-arbitrary-file-deletion 2024-08-22T16:29:45.000Z https://wordsec.net/vulnerabilities/plugins/wpfront-user-role-editor/wpfront-user-role-editor-320-reflected-cross-site-scripting 2021-11-23T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/accounting-for-woocommerce/accounting-for-woocommerce-168-authenticated-administrator-stored-cross-site-scripting 2025-03-11T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/user-registration/user-registration-membership-411-unauthenticated-privilege-escalation 2025-03-24T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/yith-woocommerce-wishlist/yith-woocommerce-wishlist-4100-unauthenticated-insecure-direct-object-reference-to-unauthenticated-wishlist-rename 2025-11-18T14:26:06.000Z https://wordsec.net/vulnerabilities/plugins/flexi-product-slider-grid/flexi-product-slider-and-grid-for-woocommerce-105-authenticated-contributor-local-file-inclusion-via-theme-shortcode-attribute 2026-02-13T18:20:45.000Z https://wordsec.net/vulnerabilities/plugins/propertyshift/propertyshift-100-reflected-cross-site-scripting 2024-11-04T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/current-book/current-book-101-authenticated-stored-cross-site-scripting 2021-07-14T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wp-user-frontend/user-frontend-ai-powered-frontend-posting-user-directory-profile-membership-user-registration-432-missing-authorization-to-authenticated-subscriber-subscription-pack-cancellation 2026-06-08T20:48:06.000Z https://wordsec.net/vulnerabilities/plugins/ultimate-product-catalogue/ultimate-product-catalog-wordpress-catalog-plugin-5025-cross-site-request-forgery 2022-01-06T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/ultimate-maps-by-supsystic/ultimate-maps-by-supsystic-150-missing-authorization 2026-08-18T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/bug-library/bug-library-203-reflected-cross-site-scripting 2021-09-09T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/booking-calendar-contact-form/booking-calendar-contact-form-1023-shortcode-sql-injection 2016-02-08T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/wp-file-upload/wordpress-file-upload-300-arbitrary-file-upload 2015-07-02T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/so-widgets-bundle/siteorigin-widgets-bundle-1583-authenticated-contributor-stored-cross-site-scripting 2024-02-12T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/ultimate-dashboard/ultimate-dashboard-387-missing-authorization-to-authenticated-subscriber-plugin-modules-activationdeactivation 2025-03-25T11:05:19.000Z https://wordsec.net/vulnerabilities/plugins/td-subscription/tagdiv-opt-in-builder-17-authenticated-subscriber-sql-injection-via-subscriptioncouponid-parameter 2025-04-29T19:47:32.000Z https://wordsec.net/vulnerabilities/plugins/searchpro/berqwp-all-in-one-optimization-for-core-web-vitals-cache-cdn-images-css-javascript-4115-missing-authorization 2026-09-16T18:10:00.000Z https://wordsec.net/vulnerabilities/plugins/collapsing-categories/collapsing-categories-309-authenticated-contributor-sql-injection 2026-02-16T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/prague-plugins/prague-228-unauthenticated-stored-cross-site-scripting 2026-01-27T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/woocommerce-products-filter/husky-products-filter-for-woocommerce-professional-1352-authenticated-contributor-sql-injection 2024-03-14T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/simple-events-calendar/simple-events-calendar-136-authenticated-admin-sql-injection 2017-11-03T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/peer-publish/peer-publish-10-cross-site-request-forgery 2025-11-24T19:07:03.000Z https://wordsec.net/vulnerabilities/plugins/vikwidgetsloader/vikwidgetsloader-collection-of-widgets-1123-authenticated-contributor-stored-cross-site-scripting 2026-11-04T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/vikbooking/vikbooking-hotel-booking-engine-pms-1817-unauthenticated-stored-cross-site-scripting-via-guestsdocuments-parameter 2026-11-06T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/jetwidgets-for-elementor/jetwidgets-for-elementor-1021-authenticated-author-stored-cross-site-scripting-via-animated-box-animation_effect-setting 2026-06-30T16:01:32.000Z https://wordsec.net/vulnerabilities/plugins/woocommerce-checkout-manager/woocommerce-checkout-manager-730-missing-authorization 2023-11-09T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/piotnet-addons-for-elementor-pro/piotnet-addons-for-elementor-pro-7170-unauthenticated-arbitrary-file-upload-via-form-file-upload 2026-05-18T18:28:38.000Z https://wordsec.net/vulnerabilities/plugins/yummly-rich-recipes/yummly-rich-recipes-42-cross-site-request-forgery 2025-03-24T00:00:00.000Z https://wordsec.net/vulnerabilities/plugins/imember360/imember360-39001-missing-authorization-and-sensitive-data-exposure 2014-04-28T00:00:00.000Z