CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 1302)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 1302)
Severity	Vulnerability	CVE	Installs	Published
Medium5.3	Directory Traversal to Directory Listing Media File Manager≤1.4.2Update to 1.4.3	CVE-2018-19040	—	May 11, 2018
Medium5.3	Directory Traversal to Arbitrary File Read Media File Manager≤1.4.2Update to 1.4.3	CVE-2018-19043	—	May 11, 2018
Critical9.8	Directory Traversal to Arbitrary File Relocation Media File Manager≤1.4.2Update to 1.4.3	CVE-2018-19042	—	May 11, 2018
Medium4.3	Insecure Direct Object Reference Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin<2.0.4Update to 2.0.4	CVE-2018-0590	—	May 10, 2018
Medium6.5	Authorization Bypass BBE<1.53Update to 1.53	CVE-2018-11244	—	May 10, 2018
Medium4.3	Directory Traversal Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin≤2.0.39Update to 2.0.40	CVE-2018-0588	—	May 10, 2018
Medium4.3	Authenticated Unrestricted File Upload Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin<2.0.4Update to 2.0.4	CVE-2018-0587	—	May 10, 2018
High7.5	Remote Code Execution Google Forms<0.94Update to 0.94	CVE-2018-20988	—	May 8, 2018
Medium5.5	Authenticated (Admin+) Stored Cross-Site Scripting Tagregator≤0.6No patch available	CVE-2018-10752	—	May 5, 2018
Medium6.1	Cross-Site Scripting WF Cookie Consent<1.1.4Update to 1.1.4	CVE-2018-10371	—	May 1, 2018
Medium6.1	Reflected Cross-Site Scripting Social Preview and Open Graph Tags<2.2.4.1Update to 2.2.4.1	CVE-2018-0579	—	Apr 27, 2018
Medium5.4	Cross-Site Scripting WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings<4.0.4Update to 4.0.4	CVE-2018-0577	—	Apr 27, 2018
High7.8	CSV Injection Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder<1.12.22Update to 1.12.22	CVE-2018-10504	—	Apr 27, 2018
Medium5.4	Stored Cross-Site Scripting Events Manager – Calendar, Bookings, Tickets, Appointments and more!<5.9Update to 5.9	CVE-2018-0576	—	Apr 27, 2018
Medium5.4	Reflected Cross-Site Scripting PixelYourSite – Your smart PIXEL (TAG) & API Manager<5.3.0Update to 5.3.0	CVE-2018-0578	—	Apr 27, 2018
Medium5.4	Cross-Site Scripting Responsive Cookie Consent<1.8Update to 1.8	CVE-2018-10309	—	Apr 24, 2018
Medium5.5	Authenticated Cross-Site Scripting Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin<2.0.11Update to 2.0.11	CVE-2018-10234	—	Apr 23, 2018
Medium6.1	Cross-Site Scripting WD Instagram Feed Premium≤1.3.0Update to 1.3.1	CVE-2018-10301	—	Apr 23, 2018
High8.8	Multiple Cross-Site Request Forgery Issues Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin<2.0.7Update to 2.0.7	CVE-2018-10233	—	Apr 23, 2018
Medium6.1	Cross-site scripting 10WebSocial<1.3.1Update to 1.3.1	CVE-2018-10300	—	Apr 23, 2018
Medium6.4	Stored Cross-Site Scripting Termly – GDPR/CCPA Cookie Consent Banner≤2.3.9Update to 2.3.10	CVE-2018-10310	—	Apr 22, 2018
Medium5.5	Cross Site Scripting Caldera Forms – More Than Contact Forms≤1.5.9.1Update to 1.6.0	CVE-2018-7747	—	Apr 20, 2018
Medium6.1	Reflected Cross-Site Scripting Knews Multilingual Newsletters≤1.1.0Update to 1.1.1	CVE-2012-20004	—	Apr 13, 2018
Medium6.1	Stored Cross-Site Scripting 3CX Free Live Chat, Calls & Messaging≤8.0.05Update to 8.0.06	CVE-2018-9864	—	Apr 9, 2018
High8.6	CSV Injection Contact Form DB2.10.32 – 2.10.32Update to 2.10.36	CVE-2018-9035	—	Apr 9, 2018
High7.5	Directory Traversal WP Background Takeover≤4.1.4Update to 4.1.5	CVE-2018-9118	—	Apr 6, 2018
Medium6.1	Stored Cross-Site Scripting Iptanus File Upload<4.3.4Update to 4.3.4	CVE-2018-9844	—	Apr 6, 2018
Medium4.3	Security Misconfiguration with URL Hostnames WordPress≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5	CVE-2018-10101	—	Apr 3, 2018
Medium6.4	Authenticated Stored Cross-Site Scripting via Generator Tag WordPress≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5	CVE-2018-10102	—	Apr 3, 2018
Medium5.4	Open Redirect WordPress≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5	CVE-2018-10100	—	Apr 3, 2018

Medium5.3
Directory Traversal to Directory Listing
Media File Manager
≤1.4.2Update to 1.4.3
CVE-2018-19040May 11, 2018
Medium5.3
Directory Traversal to Arbitrary File Read
Media File Manager
≤1.4.2Update to 1.4.3
CVE-2018-19043May 11, 2018
Critical9.8
Directory Traversal to Arbitrary File Relocation
Media File Manager
≤1.4.2Update to 1.4.3
CVE-2018-19042May 11, 2018
Medium4.3
Insecure Direct Object Reference
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.4Update to 2.0.4
CVE-2018-0590May 10, 2018
Medium6.5
Authorization Bypass
BBE
<1.53Update to 1.53
CVE-2018-11244May 10, 2018
Medium4.3
Directory Traversal
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.39Update to 2.0.40
CVE-2018-0588May 10, 2018
Medium4.3
Authenticated Unrestricted File Upload
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.4Update to 2.0.4
CVE-2018-0587May 10, 2018
High7.5
Remote Code Execution
Google Forms
<0.94Update to 0.94
CVE-2018-20988May 8, 2018
Medium5.5
Authenticated (Admin+) Stored Cross-Site Scripting
Tagregator
≤0.6No patch available
CVE-2018-10752May 5, 2018
Medium6.1
Cross-Site Scripting
WF Cookie Consent
<1.1.4Update to 1.1.4
CVE-2018-10371May 1, 2018
Medium6.1
Reflected Cross-Site Scripting
Social Preview and Open Graph Tags
<2.2.4.1Update to 2.2.4.1
CVE-2018-0579Apr 27, 2018
Medium5.4
Cross-Site Scripting
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
<4.0.4Update to 4.0.4
CVE-2018-0577Apr 27, 2018
High7.8
CSV Injection
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
<1.12.22Update to 1.12.22
CVE-2018-10504Apr 27, 2018
Medium5.4
Stored Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.9Update to 5.9
CVE-2018-0576Apr 27, 2018
Medium5.4
Reflected Cross-Site Scripting
PixelYourSite – Your smart PIXEL (TAG) & API Manager
<5.3.0Update to 5.3.0
CVE-2018-0578Apr 27, 2018
Medium5.4
Cross-Site Scripting
Responsive Cookie Consent
<1.8Update to 1.8
CVE-2018-10309Apr 24, 2018
Medium5.5
Authenticated Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.11Update to 2.0.11
CVE-2018-10234Apr 23, 2018
Medium6.1
Cross-Site Scripting
WD Instagram Feed Premium
≤1.3.0Update to 1.3.1
CVE-2018-10301Apr 23, 2018
High8.8
Multiple Cross-Site Request Forgery Issues
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.7Update to 2.0.7
CVE-2018-10233Apr 23, 2018
Medium6.1
Cross-site scripting
10WebSocial
<1.3.1Update to 1.3.1
CVE-2018-10300Apr 23, 2018
Medium6.4
Stored Cross-Site Scripting
Termly – GDPR/CCPA Cookie Consent Banner
≤2.3.9Update to 2.3.10
CVE-2018-10310Apr 22, 2018
Medium5.5
Cross Site Scripting
Caldera Forms – More Than Contact Forms
≤1.5.9.1Update to 1.6.0
CVE-2018-7747Apr 20, 2018
Medium6.1
Reflected Cross-Site Scripting
Knews Multilingual Newsletters
≤1.1.0Update to 1.1.1
CVE-2012-20004Apr 13, 2018
Medium6.1
Stored Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤8.0.05Update to 8.0.06
CVE-2018-9864Apr 9, 2018
High8.6
CSV Injection
Contact Form DB
2.10.32 – 2.10.32Update to 2.10.36
CVE-2018-9035Apr 9, 2018
High7.5
Directory Traversal
WP Background Takeover
≤4.1.4Update to 4.1.5
CVE-2018-9118Apr 6, 2018
Medium6.1
Stored Cross-Site Scripting
Iptanus File Upload
<4.3.4Update to 4.3.4
CVE-2018-9844Apr 6, 2018
Medium4.3
Security Misconfiguration with URL Hostnames
WordPress
≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5
CVE-2018-10101Apr 3, 2018
Medium6.4
Authenticated Stored Cross-Site Scripting via Generator Tag
WordPress
≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5
CVE-2018-10102Apr 3, 2018
Medium5.4
Open Redirect
WordPress
≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5
CVE-2018-10100Apr 3, 2018