VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 1255)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 1255)
SeverityVulnerabilityCVEInstallsPublished
Medium6.1Stored Cross-Site Scripting
Email Subscriber≤1.1No patch available
CVE-2021-24556—
High7.2Authenticated (Admin+) SQL Injection
Timeline Calendar≤1.2No patch available
CVE-2021-24553—
High7.2Authenticated SQL Injection
Simple Events Calendar≤1.4.0Update to 1.4.1
CVE-2021-24552—
High7.2Authenticated (Admin+) SQL Injection
Broken Link Manager≤0.6.5No patch available
CVE-2021-24550—
Medium5.8Reflected Cross-Site Scripting
Translate WordPress with GTranslate<2.8.65Update to 2.8.65
CVE-2021-34630—
High7.2Authenticated (Admin+) SQL Injection
Embed Youtube Video≤1.0No patch available
CVE-2021-24395—
High8.8Authenticated (Subscriber+) SQL Injection
Diary & Availability Calendar≤1.0.3No patch available
CVE-2021-24555—
High7.2Authenticated (Admin+) SQL Injection
Easy Testimonial Manager≤1.2.0No patch available
CVE-2021-24394—
High7.2Authenticated (Admin+) SQL Injection
WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件≤3.7.2No patch available
CVE-2021-24390—
High8.8Authenticated (Admin+) SQL Injection
Cashtomer≤1.0.0No patch available
CVE-2021-24391—
High7.2Authenticated (Admin+) SQL Injection
WordPress Membership SwiftCloud.io≤1.0No patch available
CVE-2021-24392—
High7.2Authenticated (Admin+) SQL Injection
Comment Highlighter≤0.13No patch available
CVE-2021-24393—
Medium6.4Stored Cross-Site Scripting
Simple Post≤1.1No patch available
CVE-2021-24567—
High8.8Authenticated Local File Inclusion
FOX – Currency Switcher Professional for WooCommerce≤1.3.7Update to 1.3.7.1
CVE-2021-24566—
Medium4.3Authorization Bypass
SendGrid≤1.11.8No patch available
CVE-2021-34629—
High7.1Reflected Cross-Site Scripting
Translate WordPress – Google Language Translator<6.0.10Update to 6.0.10
CVE-2021-4452—
Medium6.4Authenticated Stored Cross-Site Scripting
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)≤1.6.50Update to 1.6.51
CVE-2021-24531—
Medium4.8Authenticated Stored Cross-Site Scripting
Maintenance<4.03Update to 4.03
CVE-2021-24533—
Medium5.4Stored Cross-Site Scripting
Grid Gallery – for Photo Gallery, Image Gallery & Portfolio<1.2.5Update to 1.2.5
CVE-2021-24529—
High8.8NewsPlugin <= 1.0.18 – Cross-Site Request Forgery to Stored Cross-Site Scripting
NewsPlugin≤1.0.18Update to 1.1.0
CVE-2021-34631—
High7.2Authenticated (Admin+) SQL Injection
Giveaway≤1.2.2No patch available
CVE-2021-24497—
Medium5.4Stored Cross-Site Scripting
KN Fix Your Title≤1.0.1No patch available
CVE-2021-24547—
High8.8Privilege Escalation via Arbitrary Role Change
HM Multiple Roles≤1.2Update to 1.3
CVE-2021-24602—
Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
My Site Audit≤1.2.4Update to 1.2.5
CVE-2021-24445—
High8.8SQL Injection
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses≤3.2.6.7Update to 3.2.6.8
CVE-2020-6010—
Medium6.4Contributor+ Stored Cross-Site Scripting
Wonder PDF Embed≤1.6Update to 1.7
CVE-2021-24541—
Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Social Tape≤1.0No patch available
CVE-2021-24411—
Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Custom Login Redirect≤1.0.0No patch available
CVE-2021-24536—
Medium4.3Cross-Site Request Forgery
Shantz WordPress QOTD≤1.2.2No patch available
CVE-2021-24380—
Medium6.4Cross-Site Scripting
PhoneTrack Meu Site Manager≤0.1Update to 0.1.1
CVE-2021-24534—

Search VulnCrest Radar

Jump to

Are you sure?