CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 118)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset
VW Writer Blog
≤1.3.8Update to 1.3.9
- High7.2Authenticated (Admin+) Privilege Escalation
Import and export users and customers
≤2.5.1Update to 2.5.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.8Update to 4.16.9
- Medium6.46.3.0 - Authenticated (Author+) Stored Cross-Site Scripting
Kirki – Freeform Page Builder, Website Builder & Customizer
6.0.0 – 6.3.0Update to 6.3.1
- High7.3Unauthenticated Privilege Escalation
SAML Single Sign On – SSO Login
≤5.4.7Update to 6.0.0
- High7.2Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
≤1.24.0Update to 1.25.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
≤3.2.16Update to 3.2.17
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint
WP Recipe Maker
≤10.8.1Update to 10.8.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via post_title
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
≤1.24.0Update to 1.25.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker Regex
Complianz GDPR/CCPA Cookie Consent Banner
≤7.5.4Update to 7.5.5
- High8.1Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup_id' Parameter
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
≤3.2.2Update to 3.2.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields
CSS & JavaScript Toolbox
≤12.0.6Update to 12.0.7
- Medium6.5Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.44Update to 1.8.45
- High7.5Unauthenticated SQL Injection via 'store_locator_search_radius' Parameter
WP Multi Store Locator Pro
≤4.5.1Update to 4.5.2
- Medium6.1Reflected Cross-Site Scripting via Query-String Parameter Name
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
≤3.5.1Update to 3.5.2
- High8.8Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter
Mapster WP Maps
≤1.23.0Update to 1.24.0
- Medium4.3Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.6.3Update to 5.6.4
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting
FileBird – WordPress Media Library Folders & File Manager
≤6.5.6Update to 6.5.7
- High7.5Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API Parameters
Location Manager
≤2.3.38Update to 2.3.39
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content
Kubio AI Page Builder
≤2.8.4Update to 2.8.5
- Medium4.9Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.3.0Update to 9.3.1
- Medium6.5Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute
WP Inventory Manager
≤2.5.1Update to 2.5.2
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
WP Easy Pay – Payment and Donation Form Builder for Square
≤4.5.0Update to 4.5.1
- Medium4.9Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' Parameter
Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers
≤2.8.0Update to 2.8.1
- High7.5Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.8.2Update to 3.8.3
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta
VK All in One Expansion Unit
≤9.118.0Update to 9.119.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute
Strong Testimonials
≤3.3.8Update to 3.3.9
- Medium6.1Reflected DOM-Based Cross-Site Scripting via 's' Parameter
Qi Addons For Elementor
≤1.11Update to 1.11.1
- High7.5Unauthenticated Arbitrary File Read via 'folder' and 'mockups' Parameters
Printcart Store – Web to Print Product Designer for WooCommerce
≤2.8.5Update to 2.8.6
- Medium6.1Reflected Cross-Site Scripting via 'nn' Parameter
Newsletter – Send awesome emails from WordPress
≤9.3.8Update to 9.3.9