VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 1251)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 1251)
SeverityVulnerabilityCVEInstallsPublished
Medium5.4Unauthorised AJAX Calls
Visual Link Preview<2.2.3Update to 2.2.3
CVE-2021-24635—
Critical9.8Unauthenticated Arbitrary File Upload
Shopp≤1.4No patch available
CVE-2021-24493—
High8.8Cross-Site Request Forgery
Fileviewer≤2.2No patch available
CVE-2021-24491—
Medium6.5Gutenberg Blocks for Post Grid <= 2.4.9 - Unauthorized Access Controls
Post Grid Gutenberg Blocks – PostX<2.4.10Update to 2.4.10
CVE-2021-24652—
Medium6.1Reflected Cross-Site Scripting
MF Gig Calendar≤1.1Update to 1.2
CVE-2021-24510—
Medium4.8Authenticated Stored Cross-Site Scripting
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress≤2.0.2Update to 2.0.3
CVE-2021-36832—
Medium6.1Reflected Cross-Site Scripting
SP Project & Document Manager≤4.25Update to 4.26
CVE-2021-38315—
Medium6.45.0.3 - Stored Cross-Site Scripting
SEOPress – AI SEO Plugin & On-site SEO≤5.0.3Update to 5.0.4
CVE-2021-34641—
Medium4.3Cross-Site Request Forgery Bypass
Event Espresso – Event Registration & Ticketing Sales≤4.10.11Update to 4.10.12
CVE-2021-4404—
Medium4.3Cross-Site Request Forgery Bypass
Rucy≤0.4.4No patch available
CVE-2021-4396—
Critical9.8Multifactor Bypass
WP Cerber Security, Anti-spam & Malware Scan<8.9.3Update to 8.9.3
CVE-2021-37597—
Medium4.3Missing Authorization
Opal Estate≤1.6.11No patch available
CVE-2021-4388—
Medium4.3Cross-Site Request Forgery Bypass
Etsy Integration For WooCommerce≤3.3.1Update to 3.3.2
CVE-2021-4409—
Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP Advanced Ticket System, Elite Support Helpdesk<1.0.64Update to 1.0.64
CVE-2021-24623—
Medium6.1Cross-Site Request Forgery leading to Stored Cross-Site Scripting
Language Bar Flags≤1.0.8Update to 1.1.0
CVE-2021-24431—
Medium5.3Access Bypass Control
WP Cerber Security, Anti-spam & Malware Scan<8.9.3Update to 8.9.3
CVE-2021-37598—
Medium4.3Cross-Site Request Forgery Bypass
RAYS Grid≤1.2.2Update to 1.3.0
CVE-2021-4423—
Medium4.8Authenticated Stored Cross-Site Scripting
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses<2.0.44Update to 2.0.44
CVE-2021-24621—
Medium6.1Unauthenticated Stored Cross-Site Scripting
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress<2.19.2Update to 2.19.2
CVE-2021-24508—
Medium4.3Cross-Site Request Forgery Bypass
Opal Estate≤1.6.11No patch available
CVE-2021-4387—
High7.2Arbitrary File Upload
Email Artillery (MASS EMAIL)≤4.1No patch available
CVE-2021-24490—
Medium4.3Cross-Site Request Forgery Bypass
WP Security Question≤1.0.5No patch available
CVE-2021-4386—
Medium4.3Cross-Site Request Forgery Bypass
WP-Backgrounds Lite≤2.3No patch available
CVE-2021-4419—
Medium4.3Cross-Site Request Forgery Bypass
Sell Media≤2.5.5Update to 2.5.6
CVE-2021-4420—
High8.8Cross-Site Request Forgery
Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal≤3.1.2No patch available
CVE-2021-24620—
Medium6.1Reflected Cross-Site Scripting
jQuery Tagline Rotator≤0.1.5No patch available
CVE-2021-34663—
Medium6.1Reflected Cross-Site Scripting
Media Usage≤0.0.4No patch available
CVE-2021-34652—
Medium6.1Reflected Cross-Site Scripting
WP Fountain≤1.5.9No patch available
CVE-2021-34653—
Medium6.1Reflected Cross-Site Scripting
Scout bazar≤1.3.3Update to 1.3.4
CVE-2021-34643—
Medium6.1Reflected Cross-Site Scripting
Custom Post Type Relations≤1.0No patch available
CVE-2021-34654—

Search VulnCrest Radar

Jump to

Are you sure?