VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 1248)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 1248)
SeverityVulnerabilityCVEInstallsPublished
Medium6.1Reflected Cross-Site Scripting
Simple Matted Thumbnails≤1.01No patch available
CVE-2021-38339—
Medium5.35.8 - Sensitive Information Disclosure
WordPress<5.8.1Update to 5.4.7 or 5.5.6 or 5.6.5 or 5.7.3 or 5.8.1
CVE-2021-39200—
Medium6.8Block Editor Authorization Bypass
WordPress5.8 beta 1 – 5.8 beta 1Update to 5.8
CVE-2021-39203—
Medium6.1Reflected Cross-Site Scripting
Edit Comments XT≤1.0No patch available
CVE-2021-38336—
Medium6.1Reflected Cross-Site Scripting
Bug Library≤2.0.3Update to 2.0.4
CVE-2021-38355—
Medium6.1Reflected Cross-Site Scripting
Wise Agent Lead Forms≤2.0Update to 3.0
CVE-2021-38335—
Medium6.1Reflected Cross-Site Scripting
Custom Menu Plugin≤1.3.3No patch available
CVE-2021-38321—
Medium6.1Reflected Cross-Site Scripting
3D Cover Carousel≤1.0No patch available
CVE-2021-38318—
Medium6.1Reflected Cross-Site Scripting
RentPress≤6.6.4No patch available
CVE-2021-38323—
Medium6.1Reflected Cross-Site Scripting
Twitter Friends Widget≤3.1No patch available
CVE-2021-38322—
Medium6.1Reflected Cross-Site Scripting
simpleSAMLphp Authentication≤0.7.0No patch available
CVE-2021-38320—
Medium5.5Authenticated Stored Cross-Site Scripting
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator<8.1.13Update to 8.1.13
CVE-2021-36870—
High8.2Unauthenticated SQL Injection
SP Rental Manager≤1.5.3No patch available
CVE-2021-38324—
Medium6.1Reflected Cross-Site Scripting
More from Google≤0.0.2No patch available
CVE-2021-38319—
Medium6.1Reflected Cross-Site Scripting
WP Academic People List≤0.4.1No patch available
CVE-2021-38316—
Medium6.1Reflected Cross-Site Scripting
User Activation Email≤1.3.0No patch available
CVE-2021-38325—
Medium5.5Authenticated Stored Cross-Site Scripting
WP Google Maps Pro≤8.1.11Update to 8.1.12
CVE-2021-36871—
Medium6.1Konnichiwa! Membership <= 0.8.3 Reflected Cross-Site Scripting
Konnichiwa! Membership≤0.8.3No patch available
CVE-2021-38317—
High8.8Missing Authorization
Share, Print and PDF Products for WooCommerce<2.8.0Update to 2.8.0
CVE-2021-4337—
High8.8Cross-Site Request Forgery
Weather Effect<1.3.4Update to 1.3.4
CVE-2021-24683—
Medium5.4Cross-Site Scripting
Chained Quiz<1.2.7.2Update to 1.2.7.2
CVE-2021-24690—
Medium4.8Stored Cross-Site Scripting
Weather Effect≤1.3.5Update to 1.3.6
CVE-2021-24709—
Medium4.8Admin+ Stored Cross Site Scripting
WP Sitemap Page<1.7.0Update to 1.7.0
CVE-2021-24715—
Medium5.5Appointment Hour Booking <= 1.3.15 Admin+ Stored Cross-Site Scripting
Appointment Hour Booking – Booking Calendar<1.3.16Update to 1.3.16
CVE-2021-24673—
Critical9.1Unauthenticated Arbitrary Options Update
WordPress Automatic Plugin<3.53.3Update to 3.53.3
CVE-2021-4374—
Critical9.8Unuathenticated Arbitrary Options Update
Pinterest Automatic≤4.14.3Update to 4.14.4
CVE-2021-4380—
Medium5.4Authenticated Stored Cross-Site Scripting
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory<2.0.2Update to 2.0.2
CVE-2021-24654—
Medium6.1Reflected Cross-Site Scripting
Better Find and Replace – AI-Powered Suggestions≤1.2.8Update to 1.2.9
CVE-2021-24676—
Medium5.4Authenticated Stored Cross-Site Scripting
CM Tooltip Glossary<3.9.21Update to 3.9.21
CVE-2021-24678—
Medium6.1Reflected Cross-Site Scripting
Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop≤1.6.0Update to 1.6.1
CVE-2021-24679—

Search VulnCrest Radar

Jump to

Are you sure?