VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 116)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

Severity
Signals
Software

41,175 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 116)
SeverityVulnerabilityCVEInstallsPublished
Medium5.3Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint
Payment Gateway of Stripe for WooCommerce≤5.0.8Update to 5.0.9
CVE-2026-9832—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode
WP Composer – The Easiest Page Builder≤1.0.5Update to 1.0.7
CVE-2026-2422—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting
OTP Login & Register Woocommerce≤2.7.3Update to 2.7.4
CVE-2026-12402—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function
Search Atlas SEO – OTTO AI SEO Automation for WordPress≤2.6.23Update to 2.6.24
CVE-2026-15946—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via 'metasync_post_types' Parameter
Search Atlas SEO – OTTO AI SEO Automation for WordPress≤2.6.23Update to 2.6.24
CVE-2026-15947—
Medium6.5Authenticated (Author+) SQL Injection via 'order' Parameter
Create≤2.5.3Update to 2.5.4
CVE-2026-13200—
Medium6.5Authenticated (Author+) SQL Injection via 'order_by' Parameter
Create≤2.5.3Update to 2.5.4
CVE-2026-13191—
Medium4.9Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' Parameter
GoPay for WooCommerce≤1.0.34Update to 1.0.35
CVE-2026-75959—
Medium4.3Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation
BlockSpare – Gutenberg Blocks, AI Content Generator & Site Builder for news, magazine, blog and business sites≤4.2.6Update to 5.0.0
CVE-2026-1242—
Medium5.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action
Ibtana – Ecommerce Product Addons≤0.4.7.7Update to 0.4.7.8
CVE-2026-1984—
Medium6.4Authenticated (Subscriber+) Cross-Site Scripting via User Input
Redux Framework≤4.5.13Update to 4.5.14
CVE-2026-5400—
Medium4.7Unauthenticated Open Redirect via 'redirect_to' Parameter
Hide My WP Ghost – Security & Firewall≤7.0.02Update to 7.0.03
CVE-2026-7527—
High8.1Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content≤4.17.2Update to 4.17.3
CVE-2026-85658—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'license_activate_fleximp' and 'license_deactivate_fleximp' AJAX Actions
Flex Import≤3.0Update to 3.1
CVE-2026-9615—
Medium6.1Reflected Cross-Site Scripting via 'data' Dynamic Content Tag
MC4WP: Mailchimp for WordPress≤4.14.0Update to 4.14.1
CVE-2026-87917—
Medium6.5Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action
Easy Appointments≤3.12.27Update to 3.12.28
CVE-2026-9232—
Medium6.5Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter
Custom Field Template≤2.7.8Update to 2.8
CVE-2026-9855—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler
AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker)≤3.15.3Update to 3.15.4
CVE-2026-13770—
Medium5.3Missing Authorization to Unauthenticated Information Exposure
Bread≤2.9.12Update to 2.9.13
CVE-2026-4792—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
Asset CleanUp: Page Speed Booster≤1.4.0.5Update to 1.4.0.6
CVE-2026-13354—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter
WP2Social Auto Publish≤2.4.12Update to 2.4.13
CVE-2026-12042—
Critical9.1Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content
WP Recipe Maker≤10.8.1Update to 10.8.2
CVE-2026-89274—
Medium6.1Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
Tutor LMS – eLearning and online course solution≤4.0.8Update to 4.0.9
CVE-2026-89081—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter
Tutor LMS – eLearning and online course solution≤4.0.8Update to 4.0.9
CVE-2026-88944—
Medium6.5Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter
Tutor LMS – eLearning and online course solution≤4.0.8Update to 4.0.9
CVE-2026-89333—
Medium4.3Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback()
SEO Booster≤7.4.7Update to 7.4.8
CVE-2026-15660—
High8.8Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute
Save as PDF Plugin by PDFCrowd≤4.6.1Update to 4.6.2
CVE-2026-92807—
Medium6.1Reflected Cross-Site Scripting via 'keyword' Parameter
Pochipp≤1.20.2Update to 1.20.3
CVE-2026-92967—
Critical9.8Unauthenticated Arbitrary File Upload via Hidden File Upload Field
Gravity Forms≤3.1.0.4Update to 3.1.1
CVE-2026-84434—
Critical9.1Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter
Forminator Forms – Contact Form, Payment Form & Custom Form Builder≤1.57.2Update to 1.57.3
CVE-2026-92229—

Search VulnCrest Radar

Jump to

Are you sure?