CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 1236)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Stored Cross-Site Scripting
Logo Carousel
<1.7.2Update to 1.7.2
- High7.2File Uploads Extension <= 3.3.12 - Reflected Cross-Site Scripting
Ninja Forms - File Uploads
≤3.3.12Update to 3.3.13
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Easy Registration Forms
≤2.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Preview E-mails for WooCommerce
≤1.6.8Update to 2.0.0
- Medium6.4Reflected Cross-Site Scripting
Child Theme Generator
≤2.2.7No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Backup Migration
≤1.1.5Update to 1.1.6
- Critical9.8Unauthenticated Arbitrary File Upload
Wordpress Plugin Smart Product Review
≤1.0.4Update to 1.0.5
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤7.0.6.1Update to 7.0.6.2
- Medium6.1Reflected Cross-Site Scripting
SportsPress – Sports Club & League Manager
≤2.7.8Update to 2.7.9
- High8.8Cross-Site Request Forgery
Push Notifications for WordPress (Lite)
<6.0.1Update to 6.0.1
- Medium6.4Cross-Site Scripting
Mortgage Calculator
<1.5.17Update to 1.5.17
- Medium6.5Cross-Site Request Forgery
Filter Portfolio Gallery
≤1.5No patch available
- Medium4.3Cross-Site Request Forgery
Wp Limits
≤1.0No patch available
- Medium4.3Plugin's Settings Update via Cross-Site Request Forgery
WP Admin Logo Changer
≤1.0No patch available
- Critical9.8Unauthenticated SQL Injection
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
<6.67Update to 6.67
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ultimate Nofollow
≤1.4.8No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Shiny Buttons – CSS3 Button Generator for WordPress
≤1.1.0No patch available
- Medium4.3Missing Authorization
Page/Post Content Shortcode
≤1.0No patch available
- Medium4.8Authenticated (Admin+) Cross-Site Scripting
Security Audit
≤1.0.0No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Flex Local Fonts
≤1.0.0No patch available
- Medium5.4Stored Cross-Site Scripting
Display Post Metadata
<1.5.0Update to 1.5.0
- Medium6.1Cross-Site Scripting
Activity Log for WordPress
<1.0.21Update to 1.0.21
- Medium6.1Reflected Cross-Site Scripting via ppress_cc_data Parameter
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<3.2.3Update to 3.2.3
- High7.2Authenticated (Admin+) SQL Injection
Quotes Collection
≤2.5.2No patch available
- Medium4.3Authenticated (Contributor+) Arbitrary Posts/Pages Access
Improved Include Page
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Auto Featured Image (Auto Post Thumbnail)
≤3.9.2Update to 3.9.3
- Medium5.5Stored Cross-Site Scripting
Inspirational Quote Rotator
≤1.0.0No patch available
- High7.2Admin+ SQL Injection
SEO Booster
≤3.7Update to 3.8
- Medium4.3Cross-Site Request Forgery
Single Post Exporter
≤1.1.1No patch available
- High8.5Missing Authorization
Contact Form Advanced Database
≤1.0.8No patch available