CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 122)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Instructor+) Insecure Direct Object Reference
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium5.34.0.2.1 - Unauthenticated Insecure Direct Object Reference
Easy Appointments
4.0 – 4.0.2.1Update to 4.0.2.2
- Medium5.3Missing Authorization
Easy Appointments
≤4.0.2.1Update to 4.0.2.2
- High7.5Unauthenticated SQL Injection
Product Question and Answer
≤1.1.0No patch available
- Medium5.3Unauthenticated Login Protection Bypass
Hide My WP Ghost – Security & Firewall
≤7.0.10Update to 7.0.11
- Medium5.3Unauthenticated Protection Mechanism Bypass
Hide My WP Ghost – Security & Firewall
≤7.0.10Update to 7.0.11
- Medium5.34.1.3 - Missing Authorization
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder
4.0.0 – 4.1.3Update to 4.2.0
- High7.24.1.3 - Unauthenticated Stored Cross-Site Scripting
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder
4.0.0 – 4.1.3Update to 4.2.0
- High7.21.8.14 - Unauthenticated Stored Cross-Site Scripting via SVG Upload
VikBooking Hotel Booking Engine & PMS
1.8.8 – 1.8.14Update to 1.8.15
- Medium4.351.1.80 - Missing Authorization
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.80Update to 51.1.81
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.80Update to 51.1.81
- Medium4.3Authenticated (Instructor+) Insecure Direct Object Reference
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium5.3Unauthenticated Cache Poisoning
Breeze Cache
≤2.5.14Update to 2.5.15
- Medium4.3Cross-Site Request Forgery
aVideo
≤29.0No patch available
- Medium4.3Authenticated (Subscriber+) Username Enumeration
Blog2Social: Social Media Auto Post & Scheduler
≤9.0.0Update to 9.1.0
- High7.2Authenticated (Shop Manager+) Remote Code Execution
AF Companion – AI SEO, GEO, Alt Text, Performance & Site Health
≤2.1.0Update to 2.2.0
- Medium4.3Authenticated (Subscriber+) Information Exposure
Nimble Page Builder
≤3.3.8No patch available
- Medium4.3Authenticated (Bookit Staff+) Information Exposure
Bookit — Booking & Appointment Calendar
≤2.6.0.4Update to 2.6.0.5
- High7.5Unauthenticated SQL Injection
Price Drop Alert for Woo Commerce
≤1.1No patch available
- Medium4.3Authenticated (Contributor+) Information Exposure
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.80Update to 51.1.81
- Medium4.3Missing Authorization
Filter Gallery
≤1.1.4Update to 1.1.5
- High7.51.3.31 - Authenticated (Contributor+) Local File Inclusion
All Bootstrap Blocks
1.3.20 – 1.3.31No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
All Bootstrap Blocks
≤1.3.31No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
iGMS Direct Booking
≤1.0Update to 2.0
- High7.21.4.1.4 - Unauthenticated Stored Cross-Site Scripting
Master Blocks – Ultimate Blocks for Marketers
1.4.1 – 1.4.1.4Update to 1.5.0
- High7.5Unauthenticated SQL Injection
Tz Weekly Radio Schedule
≤1.8.1No patch available
- High7.5Unauthenticated SQL Injection
Tz Weekly Radio Schedule
≤1.8.1No patch available
- High7.5Unauthenticated SQL Injection
wp shortcut link and advertisement baner
≤1.2.0No patch available
- Medium5.3Unauthenticated Payment Bypass
RestroPress – Online Food Ordering System
≤3.4.5Update to 3.4.6
- Medium5.3Unauthenticated Insecure Direct Object Reference
RestroPress – Online Food Ordering System
<3.4.8Update to 3.4.8