CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 120)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.6.9Update to 5.6.10
- Medium4.9Authenticated (Administrator+) SQL Injection
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
≤2.7.2.1Update to 2.7.2.2
- Medium5.4Authenticated (Custom+) Missing Authorization to Limited Account Takeover
Booking for Appointments and Events Calendar – Amelia
≤2.4.4Update to 2.4.5
- Medium5.3Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass
Booking for Appointments and Events Calendar – Amelia
≤2.4.5Update to 2.4.6
- Medium4.9Authenticated (Editor+) SQL Injection
SKT Addons for Elementor
≤4.0Update to 4.1
- Medium4.9Authenticated (Shop Manager+) SQL Injection
WP-Lister Lite for eBay
≤3.8.11Update to 3.8.12
- Medium4.9Authenticated (Administrator+) SQL Injection
Issues and Series for Newspapers, Magazines, Publishers, Writers
≤3.1.3Update to 3.1.4
- Medium4.9Authenticated (Administrator+) SQL Injection
MoreConvert Wishlist for WooCommerce
≤1.9.21Update to 2.0.0
- Medium5.3Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure
Motors – Car Dealership & Classified Listings Plugin
≤1.4.120Update to 1.4.121
- Medium5.32.1.6 - Unauthenticated Information Exposure
MgoSync – European dropshipping and suppliers
2.1.5 – 2.1.6Update to 2.1.7
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags
Auto Upload Images
≤3.3.2Update to 3.4.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute
Custom Twitter Feeds – A Tweets Widget or X Feed Widget
≤2.8.0Update to 2.9.0
- Medium5.3Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI
≤2.34.6Update to 2.34.7
- Medium5.3Missing Authorization
Botiga Pro
≤1.6.4Update to 1.6.5
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via Media Import
Use-your-Drive | Google Drive plugin for WordPress
2.0 – 3.8.3Update to 3.9.0
- Medium5.3Missing Authorization
Mailchimp for WooCommerce
≤6.1.0Update to 6.1.1
- Medium4.3Authenticated (Hydra Host+) Insecure Direct Object Reference
Hydra Booking — Appointment Scheduling & Booking Calendar
≤1.2.3Update to 1.2.4
- Medium4.3Authenticated (Hydra Host+) Insecure Direct Object Reference
Hydra Booking — Appointment Scheduling & Booking Calendar
≤1.2.2Update to 1.2.3
- Medium5.3Unauthenticated Payment Bypass
Payment Gateway for PayPal on WooCommerce
≤9.2.0Update to 9.2.1
- Medium5.3Missing Authorization
WPGraphQL Smart Cache
≤2.3.1Update to 2.3.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
Online Scheduling and Appointment Booking System – Bookly
≤28.1Update to 28.2
- Medium4.3Missing Authorization
Checkout Field Manager (Checkout Manager) for WooCommerce
≤7.9.6Update to 7.9.7
- High7.3Social Login <= 1.5.9 - Unauthenticated Privilege Escalation
UsersWP – Social Login
≤1.5.9Update to 1.5.10
- High7.2Unauthenticated Stored Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.13.0Update to 2.13.1
- Medium4.3Missing Authorization
Unbounce Landing Pages
≤1.1.4Update to 1.1.5
- Critical9.83.5.50 - Unauthenticated Arbitrary File Upload
Ultra Addons for Contact Form 7
3.2.4 – 3.5.50Update to 3.5.51
- Medium6.1Reflected Cross-Site Scripting
Estatik Real Estate Plugin
≤4.3.4Update to 4.3.5
- Medium4.7Authenticated (Admin+) Privilege Escalation
WP Import Export Lite
≤3.9.34Update to 3.9.35
- Medium6.5Authenticated (Administrator+) Arbitrary File Deletion
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.5.2Update to 3.6.5.3
- High7.2Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling
WordPress
≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1