CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 1242)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Frontend Manager for WooCommerce <= 6.5.11 - Customer/Subscriber+ SQL Injection
WCFM – Frontend Manager for WooCommerce
≤6.5.11Update to 6.5.12
- High8.8SQL Injection
School Management System – WPSchoolPress
<2.1.10Update to 2.1.10
- Medium4.8Admin+ Stored Cross-Site Scripting
Print-O-Matic
≤2.0.2Update to 2.0.3
- Critical9.8Authentication Bypass
Pie Register – User Registration, Profiles & Content Restriction
≤3.7.1.4Update to 3.7.1.5
- Medium4.8Stored Cross-Site Scripting
School Management System – WPSchoolPress
<2.1.17Update to 2.1.17
- Medium5.5Stored Cross-Site Scripting
Qwizcards | online quizzes and flashcards
≤3.61Update to 3.62
- High7.2Admin+ SQL injection
Affiliates Manager
≤2.8.6Update to 2.8.7
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Storefront Footer Text
≤1.0.1No patch available
- Medium5.3Modern Blog WordPress Theme < 3.0.4 - Authorization Bypass
Squaretype - Modern Blog WordPress Theme
<3.0.4Update to 3.0.4
- High7.2Admin+ Arbitrary PHP Code Execution
Similar Posts – Best Related Posts Plugin for WordPress
≤3.1.5Update to 3.1.6
- Medium6.5Logs Deletion via Cross-Site Request Forgery
404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring
<3.0.9Update to 3.0.9
- Medium4.3wpDiscuz <= 7.3.3 - Arbitrary Comment Addition/Edition/Deletion by Cross-Site Request Forgery
Comments – wpDiscuz
<7.3.4Update to 7.3.4
- Critical9.8Unauthenticated SQL Injection
Pie Register – User Registration, Profiles & Content Restriction
<3.7.1.6Update to 3.7.1.6
- Medium4.3Contributor+ Arbitrary Post Schedule Deletion
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
≤2.5.1Update to 2.6.0
- Medium5.5Authenticated (Editor+) Stored Cross-Site Scripting
Comment Engine Pro
≤1.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
SpiderCatalog
≤1.7.3No patch available
- High7.2Authenticated (Admin+) SQL Injection
Unlimited PopUps
≤4.5.3No patch available
- High8.8Authenticated (Author+) SQL Injection
Schreikasten
≤0.14.18No patch available
- High7.2Authenticated (Admin+) SQL Injection
G Auto-Hyperlink
≤1.0.1No patch available
- High7.2Authenticated (Admin+) SQL Injection
Wow Forms – create any form with custom style
≤3.1.3No patch available
- Medium6.4Agent+ Stored Cross-Site Scripting
Support Board
≤3.3.4Update to 3.3.5
- High8.8Cross-Site Request Forgery
Chameleon CSS
≤1.2No patch available
- High7.2Authenticated (Admin+) SQL Injection
Post Content XMLRPC
≤1.0No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Arrival
≤1.4.2Update to 1.4.3
- High8.8Subscriber+ SQL Injection
Visitor Traffic Real Time Statistics
≤3.8Update to 3.9
- Medium4.8Admin+ Stored Cross-Site Scripting
WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel
<1.3.1Update to 1.3.1
- Medium4.3Log Deletion via Cross-Site Request Forgery
Redirect 404 Error Page to Homepage or Custom Page with Logs
≤1.7.8Update to 1.7.9
- Medium4.3Author Arbitrary Media File Renaming
Phoenix Media Rename
≤3.4.2Update to 3.4.4
- Medium4.8Admin+ Stored Cross-Site Scripting
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<5.0.07Update to 5.0.07
- Medium4.3Cross-Site Request Forgery
Genie WP Favicon
≤0.5.2No patch available