This archive contains the list of all security vulnerabilities in WordPress plugins that we (responsibly) disclosed.

Most of the vulnerabilities have been validated by:

• GridPane
• The InfoSec team of one of the largest enterprise WordPress hosts.
• A fellow white-hat hacker with 20 years of experience working with Fortune 500 and government agencies.
• Thomas Raef, CEO at wewatchyourwebsite.com

There are three reasons a vulnerability might be listed here:

• The vendor has already fixed the vulnerability.
• The vendor did not indicate any progress toward a resolution
• The vendor stated that they did not consider our findings to be a
  security issue.

Search by vendor
Search by classification
Search everything

For vendors:
Potential patches were last evaluated on September 21, 2022.
If an issue has been fixed let us know through the comment form on the respective disclosure page.