← Back

Wonderplugin

wonderplugin

4 CVEs • 4 products

Products (4)

Click to collapse
Toggle
Audio Player
audio_player
1 CVE
Wonder Video Embed
wonder_video_embed
1 CVE
Wonder Pdf Embed
wonder_pdf_embed
1 CVE
Wonder Slider Lite
wonder_slider_lite
1 CVE

CVEs (4)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-24877
1Wonderplugin
1Wonder Slider Lite
Jun 17, 2026
Feb 8, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magic Hills Pty Ltd Wonder Slider Lite allows Reflected XSS.This issue affects Wonder Slider Lite: from n/a through 13...Show more
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magic Hills Pty Ltd Wonder Slider Lite allows Reflected XSS.This issue affects Wonder Slider Lite: from n/a through 13.9.Show less
CVE-2021-24541
1Wonderplugin
1Wonder Pdf Embed
Jun 17, 2026
Aug 16, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The Wonder PDF Embed WordPress plugin before 1.7 does not escape parameters of its wonderplugin_pdf shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.
CVE-2021-24540
1Wonderplugin
1Wonder Video Embed
Jun 17, 2026
Aug 16, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The Wonder Video Embed WordPress plugin before 1.8 does not escape parameters of its wonderplugin_video shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.
CVE-2015-2199
1Wonderplugin
1Audio Player
May 6, 2026
Mar 3, 2015
N/A· v4
N/A· v3
6.5 MEDIUM· v2
Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow (1) remote authenticated users to execute arbitrary SQL commands via the item[id] parameter in a wonderplugin_...Show more
Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow (1) remote authenticated users to execute arbitrary SQL commands via the item[id] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or remote administrators to execute arbitrary SQL commands via the itemid parameter in the (2) wonderplugin_audio_show_item, (3) wonderplugin_audio_show_items, or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php.Show less