plugin
13 known security issues reported for the Administrator Z WordPress plugin. Most recent disclosed Apr 16, 2025.
Running Administrator Z on your site? Check whether your installed version is affected.
Scan your site freeThe Administrator Z plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2025.03.28. This makes it possible for authenticated attackers, with Administrator-level access and above, to perform actions on files outside of the originally intended directory.
[en] Path Traversal vulnerability in Quý Lê 91 Administrator Z allows Path Traversal. This issue affects Administrator Z: from n/a through 2025.03.28.
[en] Missing Authorization vulnerability in Quý Lê 91 Administrator Z allows Privilege Escalation. This issue affects Administrator Z: from n/a through 2025.03.24.
The Administrator Z plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2025.09.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in p...
The Administrator Z plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and excluding, 2026.05.10. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site...
[en] Cross-Site Request Forgery (CSRF) vulnerability in Quý Lê 91 Administrator Z allows Cross Site Request Forgery. This issue affects Administrator Z: from n/a through 2025.03.04.
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Quý Lê 91 Administrator Z allows DOM-Based XSS. This issue affects Administrator Z: from n/a through 2025.03.04.
The Administrator Z plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the adminz_import_backup() function in all versions up to, and including, 2025.03.24. This makes it possible for authenticated attackers, with Subscriber...
[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quyle91 Administrator Z allows Blind SQL Injection.This issue affects Administrator Z: from n/a through 2024.11.04.
The Administrator Z plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2024.10.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access...
The Administrator Z plugin for WordPress uses Advanced Custom Fields which has a file upload vulnerability in versions up to, and including, 5.12.2. This makes it possible for users without the upload_files capability, such as contributors, or unauthenticated users in cases where a frontend form is added to the site, t...
The Administrator Z plugin for WordPress uses Advanced Custom Fields which has a file upload vulnerability in versions up to, and including, 5.12.2. This makes it possible for users without the upload_files capability, such as contributors, or unauthenticated users in cases where a frontend form is added to the site, t...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free