CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 1232)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
Affiliates Manager
≤2.8.9Update to 2.9.0
- Medium5.4Settings Update to Stored Cross-Site Scripting
Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce
<11.0.7Update to 11.0.7
- High8.8Cross-Site Request Forgery to Arbitrary Ad Deletion
WP125
≤1.5.4Update to 1.5.5
- Medium6.1Reflected Cross-Site Scripting
Brevo – Email, SMS, Web Push, Chat, and more.
<3.1.25Update to 3.1.25
- High7.5Unauthenticated Plugin Deactivation
Protect WP Admin
≤3.6Update to 3.7
- Medium6.1Open Redirect
Event Tickets and Registration
≤5.2.1Update to 5.2.2
- High8.8SQL Injection
WP Visitor Statistics (Real Time Traffic)
<4.8Update to 4.8
- Medium6.1Reflected Cross-Site Scripting
Smart SEO Tool – SEO优化插件
<3.0.6Update to 3.0.6
- High7.2Admin+ SQL Injection via forum_id
Asgaros Forum
≤1.15.14Update to 1.15.15
- High8.8Multiple Cross-Site Request Forgery vulnerabilities
Simple Download Monitor
≤3.9.8Update to 3.9.9
- Medium5.4Contributor+ Stored Cross-Site Scripting via Shortcodes
Simple Download Monitor
≤3.9.10Update to 3.9.11
- Medium6.1Reflected Cross-Site Scripting
Easy Forms for Mailchimp
<6.8.6Update to 6.8.6
- Medium6.4Subscriber+ Stored Cross-Site Scripting
Five Star Restaurant Reservations – WordPress Booking Plugin
≤2.4.7Update to 2.4.8
- Medium6.1Reflected Cross-Site Scripting
Backup and Staging by WP Time Capsule
≤1.22.6Update to 1.22.7
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤13.1.0.9Update to 14.0.0
- Medium5.4Open Redirect via redirect parameter
AnyComment
<0.3.5Update to 0.3.5
- Medium4.3Subscriber+ Event Creation
Event Calendar WD version
≤1.1.50Update to 1.1.51
- Medium4.8Cross-Site Scripting
SEUR Oficial
<1.7.0Update to 1.7.0
- Medium6.1Reflected Cross-Site Scripting
Event Calendar WD version
≤1.1.50Update to 1.1.51
- Medium6.1Reflected Cross-Site Scripting
ACF Photo Gallery Field
≤1.7.4Update to 1.7.5
- Low3.4Cross-Site Scripting
tarteaucitron.io – Cookie Banner & GDPR Consent Management
≤1.6Update to 1.6.1
- Medium6.1Reflected Cross-Site Scripting
Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages
≤1.4.9.5Update to 1.4.9.6
- High8.8Crisp Live Chat <= 0.31 Cross-Site Request Forgery to Stored Cross-Site Scripting
Crisp – Live Chat and AI Chatbot
≤0.31Update to 0.32
- Medium5.4Reflected Cross-Site Scripting
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress
<4.1.1Update to 4.1.1
- Critical9.8Unauthenticated Arbitrary Options Update
Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )
≤9.6.1Update to 9.6.2
- Medium5.5Authenticated Stored Cross-Site Scripting
AMP for WP – Accelerated Mobile Pages
≤1.0.77.32Update to 1.0.77.33
- High8.8Contributor+ SQL Injection
Post Grid
<2.1.13Update to 2.1.13
- Critical9.64.1.5.2 - Authenticated SQL Injection
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
4.1.3.1 – 4.1.5.2Update to 4.1.5.3
- High8.84.1.5.2 Authorization Bypass
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
4.0.0 – 4.1.5.2Update to 4.1.5.3
- Medium6.1WooCommerce myghpay Payment Gateway <= 3.0 Reflected Cross-Site Scripting
myghpay WooCommerce Payment Gateway
≤3.0No patch available