CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 1266)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery to Arbitrary Payment History Update
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.11.1Update to 5.11.2
- High8.8Cross-Site Request Forgery to Arbitrary Listing Export
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.11.1Update to 5.11.2
- High7.2Authenticated PHP4 Upload
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.11Update to 5.11.1
- High8.8Cross-Site Request Forgery
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.11Update to 5.11.1
- High7.2Arbitrary File Upload
College publisher Import
≤0.1No patch available
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.10.1Update to 5.11
- Medium6.4Authenticated (Subscriber+) Cross-Site Scripting
Contact Form Check Tester
≤1.0.2No patch available
- High8.8Arbitrary File Upload
classyfrieds
≤3.8No patch available
- High7.2Cross-Site Request Forgery
Event Banner
≤1.3No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting
Larsens Calender
≤1.2No patch available
- High8.8Cross-Site Request Forgery
Media File Renamer: Rename Images & Files for SEO (AI-Powered)
≤5.2.5Update to 5.2.6
- Medium5.4Insecure Default to Unauthorized Page Editing
WP Page Builder
<1.2.4Update to 1.2.4
- Critical9.8Arbitrary File Upload
Imagements
≤1.2.5No patch available
- Medium6.4Job Board WordPress Theme <= 2.0.31 - Stored Cross-Site Scripting
Workscout Core
<1.3.4Update to 1.3.4
- High7.4Multiple Stored Cross-Site scripting
WP Page Builder
<1.2.4Update to 1.2.4
- Medium6.1Reflected Cross-Site Scripting
Stop Spammers Classic
<2021.9Update to 2021.9
- Medium6.1Reflected Cross-Site Scripting
OpenID Connect Generic Client
3.8.0 – <3.8.2Update to 3.8.2
- Medium6.5Arbitrary License Options Update
WPBakery Page Builder Clipboard
<4.5.8Update to 4.5.8
- Medium5.5Authenticated Local File Inclusion
Tutor LMS – eLearning and online course solution
≤1.8.7Update to 1.8.8
- Medium6.4Stored Cross-Site Scripting
WPBakery Page Builder Clipboard
<4.5.6Update to 4.5.6
- Medium6.1Reflected Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction
<3.7.0.1Update to 3.7.0.1
- Critical9.8Arbitrary File Upload
Business Hours Pro WordPress Plugin
≤5.5.0No patch available
- Medium4.8Authenticated Stored Cross-Site Scripting
Erident Custom Login Page & Dashboard
≤3.5.8Update to 3.5.9
- Medium6.1Reflected Cross-Site Scripting
Realteo
≤1.2.3Update to 1.2.4
- Critical9.9Privilege Escalation
Controlled Admin Access
<1.5.6Update to 1.5.6
- Medium6.1Reflected Cross Site Scripting
Ivory Search – WordPress Search Plugin
≤4.6Update to 4.6.1
- Medium6.1Reflected Cross-Site Scripting
Cooked Pro
<1.7.5.6Update to 1.7.5.6
- Medium6.1Reflected Cross-Site Scripting
Advanced Booking Calendar
<1.6.8Update to 1.6.8
- Medium5.5Authenticated Stored Cross-Site Scripting
Virtual Robots.txt
≤1.9Update to 1.10
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Login Security and History
≤1.0No patch available