2025

The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allo

The Page Builder: Pagelayer WordPress plugin before 1.9.0 does not sanitise and escape some of its settings, which coul

The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high

The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow

The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow h

The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high pri

The Page Builder: Pagelayer WordPress plugin before 1.8.8 does not sanitise and escape some of its settings, which coul

The Simple Nav Archives WordPress plugin through 2.1.3 does not have CSRF check in place when updating its settings, whi

The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers whe

The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which co

The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow

The GamiPress WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could a

The Smart Post Show WordPress plugin before 3.0.1 does not sanitise and escape some of its settings, which could allow

The BabelZ WordPress plugin through 1.1.5 does not have CSRF check in some places, and is missing sanitisation as well

The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could

The JavaScript Logic WordPress plugin through 0.1 does not have CSRF check in some places, and is missing sanitisation a

The PeoplePond WordPress plugin through 1.1.9 does not have CSRF check in some places, and is missing sanitisation as we

The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could

The Custom Author Base WordPress plugin through 1.1.1 does not have CSRF check in place when updating its settings, whic

The Smooth Gallery Replacement WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sani

The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloade

The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers

The Joy Of Text Lite WordPress plugin through 2.3.1 does not have CSRF check in place when updating its settings, which

The ClickSold IDX WordPress plugin through 1.90 does not sanitise and escape some of its settings, which could allow hig

In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you

The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high

The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could all

The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow hig

The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow hi

The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high

The PVN Auth Popup WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before o

The PVN Auth Popup WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow h

The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as

The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting

The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high priv

The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirectio

The ProfilePro WordPress plugin through 1.3 does not sanitise and escape some parameters and lacks proper access control

The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outpu

The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, wh

The CTT Expresso para WooCommerce WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, whic

The DL Yandex Metrika WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow

The Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could a

The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.3 does not validate and escape some of its short

The CM Tooltip Glossary WordPress plugin before 4.3.4 does not sanitise and escape some of its settings, which could all

The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing use

The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blo

The Save as Image Plugin by Pdfcrowd WordPress plugin before 3.2.2 does not sanitise and escape some of its settings, wh

The Easy Property Listings WordPress plugin before 3.5.4 does not sanitise and escape some of its settings, which could

The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin

The Ultimate Noindex Nofollow Tool II WordPress plugin before 1.3.6 does not sanitise and escape some of its settings, w