CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 1233)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Directory Traversal/Arbitrary File Read
TrueRanker
≤2.2.2Update to 2.2.4
- Medium6.1Reflected Cross-Site Scripting
Simple Image Gallery
≤1.0.6No patch available
- Medium6.1Responsive, Flat, Simple FAQ <= 1.4.8 - Reflected Cross-Site Scripting
duoFAQ - Responsive, Flat, Simple FAQ
≤1.4.8No patch available
- Medium6.1Reflected Cross-Site Scripting
Real WYSIWYG
≤0.0.2No patch available
- High7.5Sensitive Data Disclosure
The Plus Addons for Elementor Page Builder Pro
<5.0.7Update to 5.0.7
- Medium6.1Reflected Cross-Site Scripting
Out-of-the-Box
<1.20.3Update to 1.20.3
- Medium6.1Reflected Cross-Site Scripting
H5P CSS Editor
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Parsian Bank Gateway for Woocommerce
≤1.0No patch available
- Medium6.1.htaccess Redirect <= 0.3.1 Reflected Cross-Site Scripting
.htaccess Redirect
≤0.3.1No patch available
- Medium6.1Reflected Cross-Site Scripting
FOX – Currency Switcher Professional for WooCommerce
≤1.3.7.2Update to 1.3.7.3
- Critical9.8Pro <= 5.0.6 - SQL Injection
The Plus Addons for Elementor Page Builder Pro
<5.0.7Update to 5.0.7
- Medium6.1WooCommerce EnvioPack <= 1.2 Reflected Cross-Site Scripting
WooCommerce EnvioPack
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
link-list-manager
≤1.0No patch available
- Medium4.7Reflected Cross-Site Scripting
WP Cloud Plugins - Box (Lets-Box)
<1.15.3Update to 1.15.3
- Medium6.1Reflected Cross-Site Scripting
Magic Post Voice
≤1.2No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
AMP for WP – Accelerated Mobile Pages
≤1.0.77.31Update to 1.0.77.32
- Medium6.1Reflected Cross-Site Scripting
WP Booking System – Booking Calendar
<2.0.15Update to 2.0.15
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
tarteaucitron.io – Cookie Banner & GDPR Consent Management
≤1.5.4Update to 1.6
- Medium6.5Arbitrary Post Deletion via Cross-Site Request Forgery
Accept Donations with PayPal & Stripe
≤1.3.3Update to 1.3.4
- Medium4.8Stored Cross-Site Scripting
Fathom Analytics for WP
≤3.0.4Update to 3.0.5
- Medium5.4Missing Authorization
Maps Plugin using Google Maps for WordPress – WP Google Map
≤1.8.0Update to 1.8.1
- Critical9.8Authentication Bypass
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤5.0.1.7Update to 5.0.1.8
- Critical9.8Unauthenticated Arbitrary Options Update
PublishPress Capabilities: User Role Access Control, Admin Area Permissions
<2.3.1Update to 2.3.1
- Medium5.7Subscriber+ Arbitrary Post Deletion and Plugin Settings Update
Maps Plugin using Google Maps for WordPress – WP Google Map
≤1.8.0Update to 1.8.1
- Medium6.1Reflected Cross-Site Scripting
10WebSocial
≤1.4.28Update to 1.4.29
- Medium6.1Reflected Cross-Site Scripting
Booking Calendar
≤8.9.1Update to 8.9.2
- Medium4.7Reflected Cross-Site Scripting
Share-one-Drive | OneDrive & SharePoint plugin for WordPress
<1.15.3Update to 1.15.3
- Medium6.1Reflected Cross-Site Scripting
UpdraftPlus Premium
<1.16.66Update to 1.16.66
- Medium6.1Chaty <= 2.8.2 Reflected Cross-Site Scripting
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty
<2.8.3Update to 2.8.3
- Medium6.1Reflected Cross-Site Scripting
Use-your-Drive | Google Drive plugin for WordPress
<1.18.3Update to 1.18.3