CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 115)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Information Exposure
Easy Hide Login
≤1.6Update to 1.7
- Medium5.3Missing Authorization
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤5.9.34Update to 5.9.35
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium4.3Authenticated (Subscriber+) Information Exposure
Zportals
≤6.4.1Update to 6.4.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
Newsletters
≤4.18.0Update to 4.18.1
- Medium5.3Unauthenticated IP Spoofing to Protection Bypass
Divi Dash
≤1.0.6Update to 1.0.7
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder
≤5.3Update to 5.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates
≤3.49.0Update to 3.50.0
- Medium5.3Missing Authorization
Social Commerce for WooCommerce
≤2.5.4No patch available
- Medium5.31.2.5 - Unauthenticated Information Exposure
Lightbox
1.2.2 – 1.2.5No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
Web to Print Online Designer
≤2.14.0Update to 2.15.0
- Medium5.3Missing Authorization
E-cab Taxi Booking Manager for Woocommerce
<2.0.8Update to 2.0.8
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions
Partial Shipment for WooCommerce
≤3.4Update to 3.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'pop_tag' Widget Setting
Gum Addon for Elementor
≤1.3.15Update to 1.3.16
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action
Empik for Woocommerce
≤1.5.1Update to 1.5.2
- Medium5.3Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints
WordLift – AI powered SEO – Schema
≤3.54.10Update to 3.54.14
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input
Redux Framework
≤4.5.13Update to 4.5.14
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)
Datalogics Ecommerce Delivery – Datalogics
≤2.6.65Update to 2.6.66
- Medium5.3Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter
TikTok
≤1.4.1Update to 1.4.2
- Medium6.4Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input
YS LeadGen – Popup Builder, Contact Form Builder, Exit Intent, Optin Forms & Lead Generation
≤2.1.4Update to 2.1.5
- Medium4.7Reflected Cross-Site Scripting via ESI 'esi' Parameter
LiteSpeed Cache
≤7.9Update to 7.9.1
- High7.5Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action
YS LeadGen – Popup Builder, Contact Form Builder, Exit Intent, Optin Forms & Lead Generation
≤2.1.4Update to 2.1.5
- Medium4.9Authenticated (Administrator+) SQL Injection via 's' Parameter
WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals
≤2.5.0Update to 2.6.0
- Medium6.1Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter
WP Customer Reviews
≤3.7.8Update to 3.8.0
- Medium6.5Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting
Wow Elements Addons for Elementor
≤1.11.2Update to 1.11.3
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler
PDF Builder for WooCommerce. Create invoices,packing slips and more
≤2.0.11Update to 2.0.12
- High8.8Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter
The Welcomizer
≤2.8.1Update to 999.0
- Medium6.1Reflected Cross-Site Scripting via 'uri' and 'host' Parameters
SSL Zen — SSL Certificate Installer & HTTPS Redirects
≤4.7.42Update to 4.7.43
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightboxtext' Shortcode Attribute
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder
≤5.1.1Update to 5.1.2
- High7.2Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes
≤5.7.1Update to 5.7.2