CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 102)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated SQL Injection
Books Gallery – Book Showcase, Library & Affiliate Plugin
≤4.8.3Update to 4.8.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
oik
≤4.15.4Update to 4.16.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Download Manager
≤3.3.70Update to 3.3.71
- Medium5.33.47.14 - Missing Authorization
WP Fusion Lite – Marketing Automation and CRM Integration for WordPress
3.37.14 – 3.47.14Update to 3.48.0
- High8.1Authenticated (Author+) Arbitrary File Deletion
WEBO MCP
≤3.0.18Update to 3.0.22
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Pixfort Core
<4.3.3Update to 4.3.3
- Medium5.3Unauthenticated Information Exposure
Payments for Hubtel
≤1.0.1Update to 1.0.2
- Medium5.3Missing Authorization
Payments for Hubtel
≤1.0.1Update to 1.0.2
- Medium5.3Unauthenticated Information Exposure
Request a Quote – Quote Forms for Any WordPress Site
≤2.5.6No patch available
- Medium5.3Unauthenticated Insecure Direct Object Reference
Payments for Hubtel
≤1.0.1Update to 1.0.2
- Medium4.3Missing Authorization
WP Fusion Lite – Marketing Automation and CRM Integration for WordPress
≤3.47.0Update to 3.48.0
- Medium6.11.10.1 - Reflected Cross-Site Scripting
If-So Dynamic Content – Elementor & All Page Builders Personalization
1.8 – 1.10.1Update to 1.10.2
- Medium4.3Missing Authorization
Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More
<1.4.6Update to 1.4.6
- Medium5.3Coming Soon & Maintenance <= 4.1.19 - Unauthenticated Maintenance Mode Bypass
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
≤4.1.19Update to 4.1.20
- Medium5.3Unauthenticated Payment Bypass
Paytm Payment Gateway
≤2.8.8Update to 2.8.9
- High7.2Unauthenticated Stored Cross-Site Scripting
Paytm Payment Gateway
≤2.8.8Update to 2.8.9
- Critical9.1Unauthenticated Arbitrary File and Directory Deletion
Cache Enabler
≤1.8.16Update to 1.8.17
- Critical9.1Unauthenticated Arbitrary File Deletion
BackupSheep WordPress Backup Plugin
≤1.8No patch available
- Medium5.3Missing Authorization
Hostinger Migrator
≤1.0Update to 1.1.0
- Medium4.31.4.5 - Missing Authorization
Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More
1.2.2.1 – 1.4.5Update to 1.4.7
- Medium6.1Reflected Cross-Site Scripting
Five Star Restaurant Reviews
≤2.3.13Update to 2.3.14
- High7.5Denial of Service to Unauthenticated Site Availability Exhaustion
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
≤6.3.10Update to 6.3.11
- High7.5Unauthenticated SQL Injection
Pro Like Button
≤1.0Update to 2.0
- Medium4.41.10.1 - Authenticated (Editor+) Stored Cross-Site Scripting
If-So Dynamic Content – Elementor & All Page Builders Personalization
1.9.9 – 1.10.1Update to 1.10.2
- High7.5Unauthenticated SQL Injection
Paytm Payment Gateway
≤2.8.8Update to 2.8.9
- Medium4.4Authenticated (Shop Manager+) Stored Cross-Site Scripting
Tabs Responsive – With WooCommerce Product Tabs Extension
≤2.5No patch available
- High8.8Cross-Site Request Forgery
Featured Image from URL (FIFU)
≤6.0.7Update to 6.0.8
- High7.2HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field
HT Contact Form – Drag & Drop Form Builder for WordPress
≤2.10.2Update to 2.10.3
- High8.8Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter
ConvertPlus
≤3.6.3Update to 3.6.4
- Medium5.3Missing Authorization
WebToffee WP Backup and Migration
≤1.6.0Update to 1.6.1