CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 1277)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.3Unauthenticated Stored Cross-Site Scripting
TC Custom JavaScript
<1.2.2Update to 1.2.2
- Medium6.5KEVPoCjQuery Manager for WordPress <= 1.10.4 & jQuery Migrate Helper <= 1.4.1- Running Vulnerable Dependency
Enable jQuery Migrate Helper
≤1.4.1No patch available
- Medium6.1Reflected Cross-Site Scripting
GreenMart – Organic & Food WooCommerce WordPress Theme
<2.4.3Update to 2.4.3
- Medium4.9Authenticated SQL Injection
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
<4.5.1Update to 4.5.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
<3.6.2Update to 3.6.2
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
JetBackup – Backup, Restore & Migrate
≤1.3.9Update to 1.4.0
- High8.8Cross-Site Request Forgery
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
<4.5.1Update to 4.5.1
- High8.8Cross-Site Request Forgery
Responsive Menu – Mobile Menu & Hamburger Menu Builder
<3.1.4Update to 3.1.4
- High7.51.04 - Unauthenticated SQL Injection
SRS Simple Hits Counter
1.0.3 – 1.0.4Update to 1.1.0
- High7.2Stored Cross-Site Scripting
Knight Lab Timeline
<3.7.0Update to 3.7.0
- Medium5.5Stored Cross-Site Scripting
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
<2.9.4Update to 2.9.4
- Critical9.8Arbitrary File Upload
Adning Advertising
≤1.5.5Update to 1.5.6
- Medium6.5Unauthenticated Arbitrary File Deletion via Path Traversal
Adning Advertising
≤1.5.5Update to 1.5.6
- Medium6.4Authenticated Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
<2.9.14Update to 2.9.14
- High8.8Missing Authorization
Security Plugin, Firewall & Malware Scanner with Auto Removal
≤2.50Update to 2.51
- High7.1Reflected Cross-Site Scripting
CareerUp - Job Board WordPress Theme
<2.3.1Update to 2.3.1
- Medium5.4Multiple Authenticated Stored Cross-Site Scripting
Testimonials Widget
≤3.5.1Update to 4.0.1
- Critical9.8SQL Injection
Payment Form for PayPal Pro
<1.1.65Update to 1.1.65
- High8.8Cross-Site Request Forgery
Clean Login
≤1.10.3Update to 1.10.4
- High8.8Insecure Direct Object Reference
Advanced Forms for ACF
<1.6.9Update to 1.6.9
- Medium6.4Authenticated Stored Cross-Site Scripting
Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode
<5.1.2Update to 5.1.2
- Medium6.1Reflected Cross-Site Scripting
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
≤2.9.4Update to 2.9.5
- Medium6.5Arbitrary Quiz Deletion via Cross-Site Request Forgery
Wp-Pro-Quiz
≤0.37No patch available
- Medium4.3Cross-Site Request Forgery Bypass
Advanced Popups
≤1.1.1Update to 1.1.2
- Critical9.8Real Estate WordPress Theme <= 1.7 - SQL Injection
Nexos - Real Estate WordPress Theme
<1.8Update to 1.8
- Medium6.1Real Estate WordPress Theme < 1.8 - Cross-Site Scripting
Nexos - Real Estate WordPress Theme
<1.8Update to 1.8
- Medium6.4Authenticated Stored Cross-Site Scripting
Testimonial Rotator
<3.0.3No patch available
- Medium6.5All Comments Deletion via Cross-Site Request Forgery
Delete All Comments Easily
≤1.3No patch available
- High8.8Arbitrary File Upload
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
≤2.9.3Update to 2.9.4
- High8.8Authorization Bypass due to Improper Access Control
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
≤2.9.3Update to 2.9.4