VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 119)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 119)
SeverityVulnerabilityCVEInstallsPublished
Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid≤1.8.6Update to 1.8.7
CVE-2026-75017—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attribute
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid≤1.8.6Update to 1.8.7
CVE-2026-75016—
Medium6.5Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key
InfiniteWP Client≤1.13.9Update to 1.13.10
CVE-2026-17576—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option_key' Parameter of toggle_watermark AJAX Action
Foxtool All-in-One: Contact chat button, Custom login, Media optimize images≤2.5.3Update to 2.5.4
CVE-2026-18317—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'image_id' Parameter via ufg_save_gallery AJAX Action
Filter Gallery≤1.1.4Update to 1.1.5
CVE-2026-89138—
High8.1Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via 'ufg_gallery_id' Parameter
Filter Gallery≤1.1.4Update to 1.1.5
CVE-2026-89413—
Medium6.1Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters
EmbedPress≤4.6.5Update to 4.6.6
CVE-2026-89330—
Medium6.5Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter
Download Manager≤3.3.68Update to 3.3.69
CVE-2026-92714—
Medium5.35.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint
Divi5.0 – 5.11.1Update to 5.12.0
CVE-2026-91707—
Medium6.1Reflected Cross-Site Scripting via 'options' Parameter
Booking Calendar≤11.8.2Update to 11.8.3
CVE-2026-92561—
High7.2Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter
Booking Calendar≤11.8.2Update to 11.8.3
CVE-2026-92619—
High8.8Authenticated (Author+) PHP Object Injection via Nested JSON Post Content
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF≤6.5.5Update to 6.5.6
CVE-2026-17086—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg≤1.5.2No patch available
CVE-2026-15650—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg≤1.5.1Update to 1.5.2
CVE-2026-14855—
Medium4.3Cross-Site Request Forgery
Asset CleanUp: Page Speed Booster≤1.4.0.5Update to 1.4.0.6
CVE-2026-66571—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetBlog≤2.4.10Update to 2.4.10.1
CVE-2026-66572—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetTabs≤2.3.3.1Update to 2.3.3.2
CVE-2026-66573—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons≤8.8.3Update to 8.8.4
CVE-2026-66574—
Medium5.3Unauthenticated Insecure Direct Object Reference
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder≤51.1.81Update to 51.1.82
CVE-2026-66575—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetSearch≤3.6.3Update to 3.6.3.1
CVE-2026-66577—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetBlocks for Elementor≤1.5.2Update to 1.5.2.1
CVE-2026-66576—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Property Hive≤2.2.6Update to 2.3.0
CVE-2026-66578—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements≤2.9.2.1Update to 2.9.2.2
CVE-2026-66579—
Medium6.5Authenticated (Contributor+) SQL Injection
Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels≤7.12.0Update to 7.12.1
CVE-2026-66580—
Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
Unlimited Elements for Elementor≤2.0.19Update to 2.0.20
CVE-2026-66608—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Issues and Series for Newspapers, Magazines, Publishers, Writers≤3.1.3Update to 3.1.4
CVE-2026-66617—
Medium4.9Authenticated (Administrator+) SQL Injection
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings≤4.9.9Update to 5.0.0
CVE-2026-66618—
Medium4.9Authenticated (Administrator+) SQL Injection
Newsletters≤4.18Update to 4.18.1
CVE-2026-66619—
Medium4.9Authenticated (Administrator+) SQL Injection
WPMasterToolKit (WPMTK) – All in one plugin≤2.22.0Update to 2.23.1
CVE-2026-66624—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter
Brizy – Page Builder≤2.8.14Update to 2.8.15
CVE-2026-2585—

Search VulnCrest Radar

Jump to

Are you sure?