Wp Bulk Delete Vulnerabilities

The WP Bulk Delete plugin for WordPress is vulnerable to generic SQL Injection via the 'delete_user_roles' parameter in all versions up to, and including, 1.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authentica...

CVSS:

4.9

Affected:

up to 1.4.2

Fixed in:

1.4.3

Disclosed:

Jul 15, 2026

CVE-2026-15727 on NVD →

The WP Bulk Delete plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.3.6

Fixed in:

1.3.7

Disclosed:

Aug 27, 2025

CVE-2025-58192 on NVD →

[en] Missing Authorization vulnerability in Xylus Themes WP Bulk Delete allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Bulk Delete: from n/a through 1.3.6.

Affected:

up to 1.3.7

Fixed in:

1.3.7

Disclosed:

Aug 27, 2025

CVE-2025-58192 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xylus Themes WP Bulk Delete allows Reflected XSS.This issue affects WP Bulk Delete: from n/a through 1.3.1.

Affected:

up to 1.3.2

Fixed in:

1.3.2

Disclosed:

Oct 6, 2024

CVE-2024-47352 on NVD →

The WP Bulk Delete plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfu...

CVSS:

6.1

Affected:

up to 1.3.1

Fixed in:

1.3.2

Disclosed:

Sep 30, 2024

CVE-2024-47352 on NVD →