CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 1257)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
CP Multi View Events Calendar
≤1.3.99Update to 1.4.01
- Medium4.3Cross-Site Request Forgery Bypass
Locations
≤3.2.1Update to 4.0
- Medium4.3Cross-Site Request Forgery Bypass
Amministrazione Trasparente
≤7.1Update to 7.1.1
- Medium4.3Cross-Site Request Forgery Bypass
WP Easy Pay – Payment and Donation Form Builder for Square
≤3.2.0Update to 3.2.3
- High7.2Authenticated (Admin+) Remote Code Execution
Speed Booster Pack ⚡ PageSpeed Optimization Suite
<4.2.0Update to 4.2.0
- Medium5.4Simple Icons <= 2.7.7 - Authenticated Cross-Site Scripting
Popular Brand Icons – Simple Icons
<2.7.8Update to 2.7.8
- Medium4.3Cross-Site Request Forgery Bypass
Vuukle – Comments, Reactions, Quizzes, Share Bar & Ad Revenue
≤3.4.31Update to 4.0
- Medium4.3Cross-Site Request Forgery Bypass
Slider Hero with Video Background, Animation
≤8.2.0Update to 8.2.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP Popular Posts
≤5.3.3Update to 5.3.4
- Medium5.5Authenticated Stored Cross-Site Scripting
Forms
<1.12.3Update to 1.12.3
- High8.8Authenticated Blind SQL Injection
WooCommerce Blocks
≤5.5Update to 2.5.16 or 2.6.2 or 2.7.2 or 2.8.1 or 2.9.1 or 3.0.1 or 3.1.1 or 3.2.1 or 3.3.1 or 3.4.1 or 3.5.1 or 3.6.1 or 3.7.2 or 3.8.1 or 3.9.1 or 4.0.1 or 4.1.1 or 4.2.1 or 4.3.1 or 4.4.3 or 4.5.3 or 4.6.1 or 4.7.1 or 4.8.1 or 4.9.2 or 5.0.1 or 5.1.1 or 5.2.1 or 5.3.2 or 5.4.1 or 5.5.1
- Medium4.3Missing Authorization Checks
WP Upload Restriction
≤2.2.4Update to 2.2.5
- Medium4.3Missing Authorization Checks
WP Upload Restriction
≤2.2.4Update to 2.2.5
- Medium6.1Reflected Cross-Site Scripting
Community Events
<1.4.8Update to 1.4.8
- High8.1Cross-Site Request Forgery
Workreap - Freelance Marketplace and Directory WordPress Theme
<2.2.2Update to 2.2.2
- Critical9.8Freelance Marketplace and Directory WordPress Theme < 2.2.2 - Arbitrary File Upload
Workreap - Freelance Marketplace and Directory WordPress Theme
<2.2.2Update to 2.2.2
- High8.8Arbitrary File Upload
PWA for WP – Progressive Web Apps Made Simple
≤1.7.32Update to 1.7.33
- Medium6.4Contributor+ Stored Cross-Site Scripting
Leaflet Map
≤2.23.3Update to 3.0.0
- Medium4.8Admin+ Stored Cross-Site Scripting
Maps Plugin using Google Maps for WordPress – WP Google Map
≤1.7.6Update to 1.7.7
- Medium6.3Missing Authorization
PWA for WP – Progressive Web Apps Made Simple
≤1.7.32Update to 1.7.33
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Leaflet Map
≤2.23.3Update to 3.0.0
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤3.4.7Update to 3.4.8
- Medium6.1Reflected Cross-Site Scripting
Newspaper Lite
≤10.3.9.1Update to 11.0
- Medium5.5Stored Cross-Site Scripting
PublishPress Taxonomies – Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms
≤3.0.7.1Update to 3.0.7.2
- High7.2SQL Injection
Quiz Maker by AYS
<6.2.0.9Update to 6.2.0.9
- Medium5.4Stored Cross-Site Scripting
WP Offload SES Lite
≤1.4.4Update to 1.4.5
- Low2.7Server-Side Request Forgery
RSVPMaker
<8.7.3Update to 8.7.4
- High8.8SQL Injection
Popup Like box – Page Plugin
≤3.5.2Update to 3.5.3
- High7.2SQL Injection
Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls
<3.2.1Update to 3.2.1
- High8.8Blind SQL Injection
Portfolio Responsive Gallery
≤1.1.7Update to 1.1.8