2025

The BabelZ WordPress plugin through 1.1.5 does not have CSRF check in some places, and is missing sanitisation as well

The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could

The JavaScript Logic WordPress plugin through 0.1 does not have CSRF check in some places, and is missing sanitisation a

The PeoplePond WordPress plugin through 1.1.9 does not have CSRF check in some places, and is missing sanitisation as we

The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could

The Custom Author Base WordPress plugin through 1.1.1 does not have CSRF check in place when updating its settings, whic

The Smooth Gallery Replacement WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sani

The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloade

The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers

The Joy Of Text Lite WordPress plugin through 2.3.1 does not have CSRF check in place when updating its settings, which

The ClickSold IDX WordPress plugin through 1.90 does not sanitise and escape some of its settings, which could allow hig

The Simple Job Board WordPress plugin before 2.12.6 does not prevent uploaded files from being listed, allowing unauthen

In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you

The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high

The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could all

The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow hig

The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using

The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow hi

The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high

The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which co

The PVN Auth Popup WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before o

The PVN Auth Popup WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow h

The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as

The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which

The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting

The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high priv

The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirectio

The ProfilePro WordPress plugin through 1.3 does not sanitise and escape some parameters and lacks proper access control

The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outpu

The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, wh

The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.

The ImageMagick Engine ImageMagick Engine WordPress plugin before 1.7.11 for WordPress is vulnerable to OS Command Injec

The CTT Expresso para WooCommerce WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, whic

The DL Yandex Metrika WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow

The Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could a

The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a para

The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.3 does not validate and escape some of its short

The CM Tooltip Glossary WordPress plugin before 4.3.4 does not sanitise and escape some of its settings, which could all

The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing use

The Responsive Gallery Grid WordPress plugin before 2.3.15 does not sanitise and escape some of its settings, which coul

The Advanced Cron Manager WordPress plugin before 2.5.7 does not sanitise and escape some of its settings, which could

The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.6.9 does not sanitise and escape some of its set

The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow

The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blo

The Save as Image Plugin by Pdfcrowd WordPress plugin before 3.2.2 does not sanitise and escape some of its settings, wh

The Easy Property Listings WordPress plugin before 3.5.4 does not sanitise and escape some of its settings, which could

The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin

The Ultimate Noindex Nofollow Tool II WordPress plugin before 1.3.6 does not sanitise and escape some of its settings, w

The S3Player WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the p

The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the