These are some of the CVEs I obtained from conducting penetration testing. (Total: 148 CVEs)
CVEs
2026
- CVE-2026-14504: Nexus Repository 3 - Authorization Bypass in Component Upload API
- CVE-2026-48935: Node.js - Permission Model bypass via FileHandle.utimes() in the promises API
- CVE-2026-5905: Google Chrome - Incorrect security UI in Permissions
- CVE-2026-5887: Google Chrome - Insufficient validation of untrusted input in Downloads
- CVE-2026-28390: OpenSSL - Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo
- CVE-2026-28389: OpenSSL - Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo
- CVE-2026-34764: Electron - Use-after-free in offscreen shared texture release() callback
2024
- CVE-2024-54252: Pinpoint Booking System Plugin <= 2.9.9.5.7 - Broken Access Control
- CVE-2024-43310: Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin <= 3.4.9 - Broken Access Control
- CVE-2024-43973: GetPaid plugin <= 2.8.11 - Broken Access Control
- CVE-2024-43933: WPMobile.App plugin <= 11.48 - CSRF to Stored XSS
- CVE-2024-43984: Podlove Podcast Publisher plugin <= 4.1.13 - CSRF to Remote Code Execution (RCE)
- CVE-2024-49302: WordPress Portfolio Builder – Portfolio Gallery plugin <= 1.1.7 - Cross Site Scripting (XSS)
- CVE-2024-49311: Edwiser Bridge plugin <= 3.0.7 - Cross Site Scripting (XSS)
- CVE-2024-43997: easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg plugin <= 2.4.14 - Reflected Cross Site Scripting (XSS)
- CVE-2024-49304: Pinpoint Booking System plugin <= 2.9.9.5.7 - CSRF to Stored Cross Site Scripting (XSS)
- CVE-2024-49312: Edwiser Bridge plugin <= 3.0.7 - Server Side Request Forgery (SSRF)
- CVE-2024-43983: Podlove Podcast Publisher plugin <= 4.1.13 - Cross Site Scripting (XSS)
- CVE-2024-44064: Like Button Rating LikeBtn plugin <= 2.6.53 - Reflected Cross Site Scripting (XSS)
- CVE-2024-43309: WP Telegram Widget and Join Link plugin <= 2.1.27 - Cross Site Scripting (XSS)
- CVE-2024-5059: Event Monster Plugin <= 1.4.0 - Sensitive Data Exposure
- CVE-2024-34754: Contact Form Widget plugin <= 1.3.9 - Sensitive Data Exposure
- CVE-2024-1134: SEOPress – On-site SEO <= 7.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-33924: Realtyna Organic IDX plugin + WPL Real Estate plugin <= 4.14.4 - Cross Site Scripting (XSS)
- CVE-2024-32132: CBX Bookmark & Favorite plugin <= 1.7.20 - SQL Injection
- CVE-2024-32134: Forms to Zapier plugin <= 1.1.12 - Auth. SQL Injection
- CVE-2024-31356: User Activity Log plugin <= 1.8 - Auth. SQL Injection
- CVE-2024-31260: Edwiser Bridge plugin <= 3.0.2 - SQL Injection
- CVE-2024-31116: 10Web Map Builder for Google Maps plugin <= 1.0.74 - SQL Injection
- CVE-2024-30523: Paid Memberships Pro – Mailchimp Add On plugin <= 2.3.4 - Sensitive Data Exposure
- CVE-2024-30478: Announcement & Notification Banner – Bulletin plugin <= 3.8.5 - SQL Injection
- CVE-2024-0966: Shariff Wrapper <= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1053: Event Tickets and Registration <= 5.8.1 - Missing Authorization
- CVE-2024-1081: 3D FlipBook – PDF Flipbook WordPress <= 1.15.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Bookmarks
- CVE-2024-1092: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.1 - Missing Authorization
- CVE-2024-0895: PDF Flipbook, 3D Flipbook – DearFlip <= 2.2.26 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-22301: Albo Pretorio Online Plugin <= 4.6.6 - Sensitive Data Exposure
2023
- CVE-2023-23823: Enhanced Text Widget plugin <= 1.5.8 - Broken Access Control
- CVE-2023-46784: ICS Calendar plugin <= 10.12.0.3 - SSRF and Arbitrary File Read
- CVE-2023-52144: Product Feed Manager plugin <= 7.3.15 - Directory Traversal
- CVE-2023-52142: Events Shortcodes & Templates For The Events Calendar Plugin <= 2.3.1 - SQL Injection
- CVE-2023-52131: Page Generator Plugin <= 1.7.1 - SQL Injection
- CVE-2023-52132: WP Adminify Plugin <= 3.1.6 - SQL Injection
- CVE-2023-52133: Most And Least Read Posts Widget Plugin <= 2.5.16 - SQL Injection
- CVE-2023-52134: GEO my WordPress Plugin <= 4.0.2 - SQL Injection
- CVE-2023-52180: Recipe Maker For Your Food Blog from Zip Recipes Plugin <= 8.1.0 - SQL Injection
- CVE-2023-51688: eCommerce Product Catalog Plugin <= 3.3.26 - Sensitive Data Exposure
- CVE-2023-51687: Product Catalog Simple Plugin <= 1.7.6 - Sensitive Data Exposure
- CVE-2023-52135: WS Form LITE Plugin <= 1.9.170 - SQL Injection
- CVE-2023-50844: WP Mail Catcher Plugin <= 2.1.3 - SQL Injection
- CVE-2023-50845: GeoDirectory Plugin <= 2.3.28 - SQL Injection
- CVE-2023-50846: RegistrationMagic Plugin <= 5.2.4.5 - SQL Injection
- CVE-2023-50847: Welcart e-Commerce Plugin <= 2.9.3 - SQL Injection
- CVE-2023-50848: 404 Solution Plugin <= 2.34.0 - SQL Injection
- CVE-2023-50849: e2pdf Plugin <= 1.20.23 - SQL Injection
- CVE-2023-50852: BookIt Plugin <= 2.4.3 - SQL Injection
- CVE-2023-50851: Simply Schedule Appointments Plugin < 1.6.6.1 - SQL Injection
- CVE-2023-50853: Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration Plugin <= 1.75.0 - SQL Injection
- CVE-2023-50854: Squirrly SEO - Advanced Pack Plugin <= 2.3.8 - SQL Injection
- CVE-2023-50855: Pre* Party Resource Hints Plugin <= 1.8.18 - SQL Injection
- CVE-2023-50856: Funnel Builder for WordPress by FunnelKit Plugin <= 2.14.3 - SQL Injection
- CVE-2023-50857: Automation By Autonami Plugin <= 2.6.1 - SQL Injection
- CVE-2023-47852: Link Whisper Free Plugin <= 0.6.5 - SQL Injection
- CVE-2023-47236: iPages Flipbook Plugin <= 1.4.8 - SQL Injection
- CVE-2023-49836: Cookie Bar Plugin <= 2.0 - Cross Site Scripting (XSS)
- CVE-2023-47829: Quick Call Button Plugin <= 1.2.9 - Cross Site Scripting (XSS)
- CVE-2023-27461: When Last Login Plugin <= 1.2.1 - Cross Site Request Forgery (CSRF)
- CVE-2023-26543: WP Meteor Page Speed Optimization Topping Plugin <= 3.1.4 - Cross Site Request Forgery (CSRF)
- CVE-2023-46822: WooCommerce – Store Exporter Plugin <= 2.7.2 - Cross Site Scripting (XSS)
- CVE-2023-46823: ImageLinks Interactive Image Builder Plugin <= 1.5.4 - SQL Injection
- CVE-2023-46821: GD Security Headers Plugin <= 1.7 - SQL Injection
- CVE-2023-44473: Table of Contents Plus Plugin <= 2302 - Cross Site Request Forgery (CSRF)
- CVE-2023-25989: Cross-Site Request Forgery (CSRF) vulnerability in multiple WordPress plugins by Meks
- CVE-2023-28989: Happy Addons for Elementor Plugin <= 3.8.2 - Cross Site Request Forgery (CSRF)
- CVE-2023-23711: A2 Optimized WP Plugin <= 3.0.4 - Cross Site Request Forgery (CSRF)
- CVE-2023-22700: PixelYourSite – Your smart PIXEL (TAG) Manager Plugin <= 9.3.0 - Cross Site Request Forgery (CSRF)
2022
- CVE-2022-46796: CURCY plugin <= 2.1.25 - Unauthenticated plugin settings change
- CVE-2022-46795: Print Invoice & Delivery Notes for WooCommerce plugin <= 4.7.2 - CSRF Plugin Settings Reset
- CVE-2022-47175: Royal Elementor Addons Plugin <= 1.3.75 - Cross Site Request Forgery (CSRF)
- CVE-2022-47169: Visibility Logic for Elementor Plugin <= 2.3.4 - Cross Site Request Forgery (CSRF)
- CVE-2022-47172: WooLentor Plugin <= 2.6.2 - Cross Site Request Forgery (CSRF)
- CVE-2022-45372: Product Gallery Slider for WooCommerce Plugin <= 2.2.8 - Cross Site Request Forgery (CSRF)
- CVE-2022-33974: Custom Twitter Feeds (Tweets Widget) Plugin <= 1.8.4 - Cross Site Request Forgery (CSRF)
- CVE-2022-47174: Performance Lab Plugin <= 2.2.0 - Cross Site Request Forgery (CSRF)
- CVE-2022-47178: Simple Share Buttons Adder Plugin <= 8.4.7 - Cross Site Request Forgery (CSRF)
- CVE-2022-47136: Ninja Tables Plugin <= 4.3.4 - Cross Site Request Forgery (CSRF)
- CVE-2022-45371: ShopEngine Plugin <= 4.1.1 - Cross Site Request Forgery (CSRF)
- CVE-2022-45367: Custom Order Numbers for WooCommerce Plugin <= 1.4.0 - Cross Site Request Forgery (CSRF)
- CVE-2022-47149: Shortlinks by Pretty Links Plugin <= 3.4.0 - Cross Site Request Forgery (CSRF)
- CVE-2022-47161: Health Check & Troubleshooting Plugin <= 1.5.1 - Cross Site Request Forgery (CSRF)
- CVE-2022-46794: WooCommerce Weight Based Shipping Plugin <= 5.4.1 - Cross Site Request Forgery (CSRF)
- CVE-2022-46853: The Post Grid Plugin <= 5.0.4 - Cross Site Request Forgery (CSRF)
- CVE-2022-46851: Starter Templates Plugin <= 3.1.20 - Cross Site Request Forgery (CSRF)
- CVE-2022-45076: Flexible Elementor Panel Plugin <= 2.3.8 - Cross Site Request Forgery (CSRF)
- CVE-2022-45376: Side Cart Woocommerce (Ajax) Plugin < 2.1 - Cross Site Request Forgery (CSRF)
- CVE-2022-47137: Ninja Tables Plugin <= 4.3.4 - Cross Site Scripting (XSS)
- CVE-2022-33961: YellowPencil Visual CSS Style Editor Plugin <= 7.5.8 - Cross Site Scripting (XSS)
- CVE-2022-32970: Themify Portfolio Post Plugin <= 1.2.4 - Cross Site Scripting (XSS)
- CVE-2022-46852: WP Table Builder – WordPress Table Plugin Plugin <= 1.4.6 - Cross Site Scripting (XSS)
- CVE-2022-46793: Product Feed PRO for WooCommerce Plugin <= 12.4.4 - Cross Site Request Forgery (CSRF)
- CVE-2022-47170: Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.48 - Cross Site Scripting (XSS)
- CVE-2022-46855: Responsive Pricing Table Plugin <= 5.1.6 - Cross Site Scripting (XSS)
- CVE-2022-46848: Visualizer Plugin <= 3.9.1 - Cross Site Scripting (XSS)
- CVE-2022-34148: Backup Guard Plugin <= 1.6.9.0 - Cross Site Scripting (XSS)
- CVE-2022-47166: Void Contact Form 7 Widget For Elementor Page Builder Plugin <= 2.1.1 - Cross Site Request Forgery (CSRF)
- CVE-2022-47148: WooCommerce PDF Invoices & Packing Slips Plugin <= 3.2.5 - Cross Site Request Forgery (CSRF)
- CVE-2022-46798: WooLentor Plugin <= 2.5.1 - Cross Site Request Forgery (CSRF)
- CVE-2022-46797: Conversios.io Plugin <= 5.2.3 - Cross Site Request Forgery (CSRF)
- CVE-2022-45068: Mercado Pago payments for WooCommerce Plugin <= 6.3.1 - Cross Site Request Forgery (CSRF)
- CVE-2022-40198: TeraWallet – For WooCommerce Plugin <= 1.3.24 - Cross Site Request Forgery (CSRF)
- CVE-2022-45067: Exclusive Addons Elementor Plugin <= 2.6.1 - Cross Site Request Forgery (CSRF)
- CVE-2022-36401: TeraWallet – For WooCommerce Plugin <= 1.3.24 - Cross Site Request Forgery (CSRF)
- CVE-2022-26366: AdRotate Banner Manager Plugin <= 5.9 - Cross Site Request Forgery (CSRF)
- CVE-2022-34654: Manage Notification E-mails Plugin <= 1.8.2 - Cross Site Request Forgery (CSRF)
- CVE-2022-43463: Custom Product Tabs for WooCommerce plugin <= 1.7.9 - Auth. Stored Cross-Site Scripting (XSS)
- CVE-2022-40687: Creative Mail plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF)
- CVE-2022-41805: Booster for WooCommerce plugin <= 5.6.6 - Cross-Site Request Forgery (CSRF)
- CVE-2022-40686: Creative Mail plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF)
- CVE-2022-43488: Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 - Cross-Site Request Forgery (CSRF)
- CVE-2022-32587: WP Page Widget plugin <= 3.9 - Cross-Site Request Forgery (CSRF)
- CVE-2022-32776: Advanced Ads – Ad Manager & AdSense plugin <= 1.31.1 - Auth. Stored Cross-Site Scripting (XSS)
- CVE-2022-38137: Analytify plugin <= 4.2.2 - Cross-Site Request Forgery (CSRF)
- CVE-2022-43481: Advanced Coupons for WooCommerce Coupons plugin <= 4.5 - Cross-Site Request Forgery (CSRF)
- CVE-2022-43491: Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 - Cross-Site Request Forgery (CSRF)
- CVE-2022-25952: Content Egg plugin <= 5.4.0 - Cross-Site Request Forgery (CSRF)
- CVE-2022-40132: Seriously Simple Podcasting plugin <= 2.16.0 - Cross-Site Request Forgery (CSRF)
- CVE-2022-38704: SEO Redirection plugin <= 8.9 - Cross-Site Request Forgery (CSRF)
- CVE-2022-36340: MailOptin plugin <= 1.2.49.0 - Unauthenticated Optin Campaign Cache Deletion
- CVE-2022-38134: Customer Reviews for WooCommerce plugin <= 5.3.5 - Authenticated Broken Access Control
- CVE-2022-38470: Customer Reviews for WooCommerce plugin <= 5.3.5 - Cross-Site Request Forgery (CSRF)
- CVE-2022-40194: Customer Reviews for WooCommerce plugin <= 5.3.5 - Sensitive Information Disclosure
- CVE-2022-38703: Button Plugin MaxButtons plugin <= 9.2 - Authenticated Stored Cross-Site Scripting (XSS)
- CVE-2022-38095: Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 - Cross-Site Request Forgery (CSRF)
- CVE-2022-38058: WP Shamsi plugin <= 4.1.1 - Authenticated Plugin Setting change
- CVE-2022-33177: Booking Calendar plugin <= 9.2.1 - Cross-Site Request Forgery (CSRF) vulnerabiulity
- CVE-2022-35726: Video Gallery plugin <= 1.3.4.5 - Broken Authentication
- CVE-2022-36282: Search Exclude plugin <= 1.2.6 - Authenticated Stored Cross-Site Scripting (XSS)
- CVE-2022-36346: MaxButtons plugin <= 9.2 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities
- CVE-2022-34347: Download Manager plugin <= 3.2.48 - Cross-Site Request Forgery (CSRF)
- CVE-2022-33201: MailerLite – Signup forms (official) plugin <= 1.5.7 - Cross-Site Request Forgery (CSRF)
- CVE-2022-27848: Modern Events Calendar Lite plugin <= 6.5.1 - Authenticated Stored Cross-Site Scripting (XSS)
- CVE-2022-27844: WPvivid plugin <= 0.9.70 - Arbitrary File Read
- CVE-2022-25618: wpDataTables plugin <= 2.1.27 - Stored Cross-Site Scripting (XSS)
- CVE-2022-23984: wpDiscuz plugin <= 7.3.11 - Sensitive Information Disclosure
- CVE-2022-23983: WP Content Copy Protection & No Right Click plugin <= 3.4.4 - Cross-Site Request Forgery (CSRF) leads to Settings Update
2021
- CVE-2021-24561: WP SMS < 5.4.13 - Authenticated Stored Cross-Site Scripting
- CVE-2021-24531: Charitable – Donation Plugin < 1.6.51 - Authenticated Stored Cross-Site Scripting (XSS)
- CVE-2021-24519: Vik Rent Car < 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS)
Security Advisories (No CVE Assigned)
These were published as vendor security advisories without a CVE being assigned, so they are listed separately and are not counted in the total above.
- Nuclei - Local File Read via Workflow File-Protocol Gate Bypass
- Nuclei - Local File Read via MySQL Client Sandbox Bypass
- Nuclei - Arbitrary Command Execution via DAST Code Signature Bypass
- Mail Logging – WP Mail Catcher - Authenticated (Admin+) SQL Injection
- Pods – Custom Content Types and Fields - Authenticated (Admin+) Cross-Site Scripting (XSS)