CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 1306)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 1306)
Severity	Vulnerability	CVE	Installs	Published
High8.8	Cross-Site Request Forgery leading to Cross-Site Scripting via the recordsArray Parameter Social Media Widget by Acurax<3.2.6Update to 3.2.6	CVE-2018-6357	—	Jan 2, 2018
Medium6.4	Authenticated Stored Cross-Site Scripting Simple Download Monitor<3.5.4Update to 3.5.4	CVE-2018-5212	—	Jan 2, 2018
Medium5.4	Authenticated Stored Cross-Site Scripting Simple Download Monitor<3.5.4Update to 3.5.4	CVE-2018-5213	—	Jan 2, 2018
High7.2	Stored Cross-Site Scripting Smart Google Code Inserter<3.5Update to 3.5	CVE-2018-3810	—	Jan 1, 2018
Medium6.1	Open Redirect furikake≤0.1.0Update to 0.1.1	CVE-2017-1000434	—	Jan 1, 2018
Critical9.8	Unauthenticated SQL Injection Smart Google Code Inserter<3.5Update to 3.5	CVE-2018-3811	—	Jan 1, 2018
Medium6.1	Cross-Site Scripting mgl-instagram-galleryall versionsNo patch available	CVE-2017-17869	—	Dec 22, 2017
Medium6.1	Cross-Site Scripting Custom Map≤1.1No patch available	CVE-2017-17744	—	Dec 19, 2017
Medium6.1	Cross-Site Scripting WP Concours≤1.1No patch available	CVE-2017-17719	—	Dec 19, 2017
Medium5.4	Cross-Site Scripting CSV Import Export≤1.1No patch available	CVE-2017-17753	—	Dec 19, 2017
Critical9.8	Unauthenticated Arbitrary File Upload accesspress-anonymous-post-pro<3.2.0Update to 3.2.0	CVE-2017-16949	—	Dec 19, 2017
Medium6.1	Multiple Versions - Cross-Site Scripting Clockwork SMS Notfications≤2.0.3No patch available	CVE-2017-17780	—	Dec 18, 2017
Medium6.1	Cross-Site Scripting Share This Image<1.04Update to 1.04	CVE-2017-18015	—	Dec 18, 2017
Medium6.1	Cross-Site Scripting SagePay Server Gateway for WooCommerce<1.0.9Update to 1.0.9	CVE-2018-5316	—	Dec 17, 2017
Medium6.1	Cross-Site Scripting WP Mailster<1.5.5Update to 1.5.5	CVE-2017-17451	—	Dec 5, 2017
Medium6.1	Cross-Site Scripting Z-URL Preview<2.0.0Update to 2.0.0	CVE-2017-18012	—	Dec 5, 2017
Medium6.1	Cross-Site Scripting Smart Marketing SMS and Newsletters Forms<2.0.0Update to 2.0.0	CVE-2017-18010	—	Dec 5, 2017
Medium6.1	Reflected Cross-Site Scripting PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin<2.0.3Update to 2.0.3	CVE-2018-20970	—	Dec 4, 2017
Medium5.4	Authorization Bypass WordPress≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1	CVE-2017-17091	—	Nov 29, 2017
Medium6.4	Authenticated Stored Cross-Site Scripting WordPress≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1	CVE-2017-17092	—	Nov 29, 2017
Medium6.4	WordPress Core < 4.9.1- Stored Cross-Site Scripting via Language WordPress≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1	CVE-2017-17093	—	Nov 29, 2017
Medium6.1	Reflected Cross-Site Scripting WordPress≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1	CVE-2017-17094	—	Nov 29, 2017
Medium6.1	Reflected Cross-Site Scripting Contact Form 7 – Clockwork SMS<2.4.1Update to 2.4.1	CVE-2017-18489	—	Nov 27, 2017
Medium6.1	Cross-Site Scripting Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF≤5.2.0Update to 5.2.2	CVE-2018-0511	—	Nov 27, 2017
High8.8	Missing Authorization Elementor Website Builder – more than just a page builder≤1.7.12Update to 1.8.0	CVE-2017-18596	—	Nov 27, 2017
Medium6.1	Cross-Site Scripting Clockwork SMS Notfications<2.4.2Update to 2.4.2	CVE-2017-18495	—	Nov 27, 2017
Medium6.1	Clockwork SMS <= 1.0.5 - Reflected Cross-Site Scripting Booking Calendar – Clockwork SMS≤1.0.5Update to 1.1.0	CVE-2017-18555	—	Nov 27, 2017
Medium6.1	Cross-Site Scripting WP Customer Area<7.4.3Update to 7.4.3	CVE-2017-18519	—	Nov 22, 2017
Medium6.1	Reflected Cross-Site Scripting Yoast SEO – Advanced SEO with real-time guidance and built-in AI≤5.7.1Update to 5.8.0	CVE-2017-16842	—	Nov 22, 2017
High8.8	Authenticated SQL Injection inlinks≤1.1No patch available	CVE-2017-16955	—	Nov 22, 2017

High8.8
Cross-Site Request Forgery leading to Cross-Site Scripting via the recordsArray Parameter
Social Media Widget by Acurax
<3.2.6Update to 3.2.6
CVE-2018-6357Jan 2, 2018
Medium6.4
Authenticated Stored Cross-Site Scripting
Simple Download Monitor
<3.5.4Update to 3.5.4
CVE-2018-5212Jan 2, 2018
Medium5.4
Authenticated Stored Cross-Site Scripting
Simple Download Monitor
<3.5.4Update to 3.5.4
CVE-2018-5213Jan 2, 2018
High7.2
Stored Cross-Site Scripting
Smart Google Code Inserter
<3.5Update to 3.5
CVE-2018-3810Jan 1, 2018
Medium6.1
Open Redirect
furikake
≤0.1.0Update to 0.1.1
CVE-2017-1000434Jan 1, 2018
Critical9.8
Unauthenticated SQL Injection
Smart Google Code Inserter
<3.5Update to 3.5
CVE-2018-3811Jan 1, 2018
Medium6.1
Cross-Site Scripting
mgl-instagram-gallery
all versionsNo patch available
CVE-2017-17869Dec 22, 2017
Medium6.1
Cross-Site Scripting
Custom Map
≤1.1No patch available
CVE-2017-17744Dec 19, 2017
Medium6.1
Cross-Site Scripting
WP Concours
≤1.1No patch available
CVE-2017-17719Dec 19, 2017
Medium5.4
Cross-Site Scripting
CSV Import Export
≤1.1No patch available
CVE-2017-17753Dec 19, 2017
Critical9.8
Unauthenticated Arbitrary File Upload
accesspress-anonymous-post-pro
<3.2.0Update to 3.2.0
CVE-2017-16949Dec 19, 2017
Medium6.1
Multiple Versions - Cross-Site Scripting
Clockwork SMS Notfications
≤2.0.3No patch available
CVE-2017-17780Dec 18, 2017
Medium6.1
Cross-Site Scripting
Share This Image
<1.04Update to 1.04
CVE-2017-18015Dec 18, 2017
Medium6.1
Cross-Site Scripting
SagePay Server Gateway for WooCommerce
<1.0.9Update to 1.0.9
CVE-2018-5316Dec 17, 2017
Medium6.1
Cross-Site Scripting
WP Mailster
<1.5.5Update to 1.5.5
CVE-2017-17451Dec 5, 2017
Medium6.1
Cross-Site Scripting
Z-URL Preview
<2.0.0Update to 2.0.0
CVE-2017-18012Dec 5, 2017
Medium6.1
Cross-Site Scripting
Smart Marketing SMS and Newsletters Forms
<2.0.0Update to 2.0.0
CVE-2017-18010Dec 5, 2017
Medium6.1
Reflected Cross-Site Scripting
PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin
<2.0.3Update to 2.0.3
CVE-2018-20970Dec 4, 2017
Medium5.4
Authorization Bypass
WordPress
≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1
CVE-2017-17091Nov 29, 2017
Medium6.4
Authenticated Stored Cross-Site Scripting
WordPress
≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1
CVE-2017-17092Nov 29, 2017
Medium6.4
WordPress Core < 4.9.1- Stored Cross-Site Scripting via Language
WordPress
≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1
CVE-2017-17093Nov 29, 2017
Medium6.1
Reflected Cross-Site Scripting
WordPress
≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1
CVE-2017-17094Nov 29, 2017
Medium6.1
Reflected Cross-Site Scripting
Contact Form 7 – Clockwork SMS
<2.4.1Update to 2.4.1
CVE-2017-18489Nov 27, 2017
Medium6.1
Cross-Site Scripting
Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF
≤5.2.0Update to 5.2.2
CVE-2018-0511Nov 27, 2017
High8.8
Missing Authorization
Elementor Website Builder – more than just a page builder
≤1.7.12Update to 1.8.0
CVE-2017-18596Nov 27, 2017
Medium6.1
Cross-Site Scripting
Clockwork SMS Notfications
<2.4.2Update to 2.4.2
CVE-2017-18495Nov 27, 2017
Medium6.1
Clockwork SMS <= 1.0.5 - Reflected Cross-Site Scripting
Booking Calendar – Clockwork SMS
≤1.0.5Update to 1.1.0
CVE-2017-18555Nov 27, 2017
Medium6.1
Cross-Site Scripting
WP Customer Area
<7.4.3Update to 7.4.3
CVE-2017-18519Nov 22, 2017
Medium6.1
Reflected Cross-Site Scripting
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤5.7.1Update to 5.8.0
CVE-2017-16842Nov 22, 2017
High8.8
Authenticated SQL Injection
inlinks
≤1.1No patch available
CVE-2017-16955Nov 22, 2017