CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 1308)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 1308)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Cross-Site Scripting Raygun≤1.8.2Update to 1.8.3	CVE-2017-18531	—	Oct 5, 2017
High8.8	Cross-Site Request Forgery Custom Sidebars – Dynamic Sidebar Classic Widget Area Manager≤3.0.9Update to 3.1.0	CVE-2017-18510	—	Oct 4, 2017
Critical9.8	Custom Registration Forms <= 3.7.9.2 - PHP Object Injection RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login<3.7.9.3Update to 3.7.9.3	CVE-2017-20208	—	Oct 2, 2017
Critical9.8	Unauthenticated PHP Object Injection Flickr Gallery<1.5.3Update to 1.5.3	CVE-2017-20207	—	Oct 2, 2017
Medium6.1	Cross-Site Scripting PDF Invoices & Packing Slips for WooCommerce<2.0.13Update to 2.0.13	CVE-2017-18506	—	Oct 2, 2017
Critical9.8	Unauthenticated PHP Object Injection Appointments<2.2.2Update to 2.2.2	CVE-2017-20206	—	Oct 2, 2017
Medium6.5	Authenticated Directory Traversal Insert Pages<3.2.4Update to 3.2.4	CVE-2017-18586	—	Sep 29, 2017
Critical9.8	SQL Injection content_timeline≤4.4.2Update to 4.4.3	CVE-2017-14507	—	Sep 26, 2017
Medium6.1	Cross-Site Request Forgery to Cross-Site Scripting Content Audit≤1.9.1Update to 1.9.2	CVE-2017-18560	—	Sep 26, 2017
High8.8	SQL Injection Hospital Management System for Wordpress≤08-03-2018Update to 22-05-2018	CVE-2017-14846	—	Sep 26, 2017
High8.8	Apartment Management System for wordpress Theme < 17-07-2019 - SQL Injection WPAMS - Apartment Management System for wordpress<17-07-2019Update to 17-07-2019	CVE-2017-14847	—	Sep 26, 2017
High8.8	Wordpress Gym Management System (Unknown Version) - SQL Injection WPGYM - Wordpress Gym Management Systemall versionsNo patch available	CVE-2017-14844	—	Sep 26, 2017
High8.8	Authenticated (Student+) SQL Injection School Management System for Wordpressall versionsNo patch available	CVE-2017-14843	—	Sep 26, 2017
High8.8	Church Management System for Wordpress Theme < 13-07-2019 - SQL Injection WPCHURCH - Church Management System for Wordpress<13-07-2019Update to 13-07-2019	CVE-2017-14845	—	Sep 26, 2017
High8.8	Authenticated SQL Injection SMSmaster – Multipurpose SMS Gateway for Wordpressall versionsNo patch available	CVE-2017-14842	—	Sep 26, 2017
Medium6.1	Cross-Site Scripting WP Jobs<1.7Update to 1.7	CVE-2017-14751	—	Sep 26, 2017
Critical9.8	SQL Injection Gallery – Image and Video Gallery with Thumbnails<1.2.1Update to 1.2.1	CVE-2017-14125	—	Sep 22, 2017
Medium5.3	Directory Traversal Smush – Image Optimization, Compression, Lazy Load, WebP & CDN≤2.7.5Update to 2.7.6	CVE-2017-15079	—	Sep 21, 2017
Critical9.8	Authentication Bypass Student Result or Employee Database≤1.6.3Update to 1.6.4	CVE-2017-14766	—	Sep 21, 2017
Medium6.1	Reflected Cross-Site Scripting 2kb Amazon Affiliates Store<2.1.1Update to 2.1.1	CVE-2017-14622	—	Sep 20, 2017
Medium4.3	Directory Traversal during unzip WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14719	—	Sep 19, 2017
Critical9.8	SQL Injection via Mishandled Placeholders WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14723	—	Sep 19, 2017
Low3.5	Open Redirect in Admin Dashboard WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14725	—	Sep 19, 2017
Medium5.5	Stored Cross-Site Scripting via Plugin Names WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14721	—	Sep 19, 2017
Medium6.4	Cross-Site Scripting via Javascript: and Data: URLs WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14718	—	Sep 19, 2017
Medium6.4	Cross-Site Scripting via Shortcodes WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14726	—	Sep 19, 2017
Medium4.9	Directory Traversal via Customizer WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14722	—	Sep 19, 2017
Medium6.4	Cross-Site Scripting via Template Name WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14720	—	Sep 19, 2017
Medium6.4	Cross-Site Scripting in oEmbed WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14724	—	Sep 19, 2017
Critical9.8	PHP Object Injection Post Pay Counter<2.731Update to 2.731	CVE-2017-18583	—	Sep 16, 2017

Medium6.1
Cross-Site Scripting
Raygun
≤1.8.2Update to 1.8.3
CVE-2017-18531Oct 5, 2017
High8.8
Cross-Site Request Forgery
Custom Sidebars – Dynamic Sidebar Classic Widget Area Manager
≤3.0.9Update to 3.1.0
CVE-2017-18510Oct 4, 2017
Critical9.8
Custom Registration Forms <= 3.7.9.2 - PHP Object Injection
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<3.7.9.3Update to 3.7.9.3
CVE-2017-20208Oct 2, 2017
Critical9.8
Unauthenticated PHP Object Injection
Flickr Gallery
<1.5.3Update to 1.5.3
CVE-2017-20207Oct 2, 2017
Medium6.1
Cross-Site Scripting
PDF Invoices & Packing Slips for WooCommerce
<2.0.13Update to 2.0.13
CVE-2017-18506Oct 2, 2017
Critical9.8
Unauthenticated PHP Object Injection
Appointments
<2.2.2Update to 2.2.2
CVE-2017-20206Oct 2, 2017
Medium6.5
Authenticated Directory Traversal
Insert Pages
<3.2.4Update to 3.2.4
CVE-2017-18586Sep 29, 2017
Critical9.8
SQL Injection
content_timeline
≤4.4.2Update to 4.4.3
CVE-2017-14507Sep 26, 2017
Medium6.1
Cross-Site Request Forgery to Cross-Site Scripting
Content Audit
≤1.9.1Update to 1.9.2
CVE-2017-18560Sep 26, 2017
High8.8
SQL Injection
Hospital Management System for Wordpress
≤08-03-2018Update to 22-05-2018
CVE-2017-14846Sep 26, 2017
High8.8
Apartment Management System for wordpress Theme < 17-07-2019 - SQL Injection
WPAMS - Apartment Management System for wordpress
<17-07-2019Update to 17-07-2019
CVE-2017-14847Sep 26, 2017
High8.8
Wordpress Gym Management System (Unknown Version) - SQL Injection
WPGYM - Wordpress Gym Management System
all versionsNo patch available
CVE-2017-14844Sep 26, 2017
High8.8
Authenticated (Student+) SQL Injection
School Management System for Wordpress
all versionsNo patch available
CVE-2017-14843Sep 26, 2017
High8.8
Church Management System for Wordpress Theme < 13-07-2019 - SQL Injection
WPCHURCH - Church Management System for Wordpress
<13-07-2019Update to 13-07-2019
CVE-2017-14845Sep 26, 2017
High8.8
Authenticated SQL Injection
SMSmaster – Multipurpose SMS Gateway for Wordpress
all versionsNo patch available
CVE-2017-14842Sep 26, 2017
Medium6.1
Cross-Site Scripting
WP Jobs
<1.7Update to 1.7
CVE-2017-14751Sep 26, 2017
Critical9.8
SQL Injection
Gallery – Image and Video Gallery with Thumbnails
<1.2.1Update to 1.2.1
CVE-2017-14125Sep 22, 2017
Medium5.3
Directory Traversal
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
≤2.7.5Update to 2.7.6
CVE-2017-15079Sep 21, 2017
Critical9.8
Authentication Bypass
Student Result or Employee Database
≤1.6.3Update to 1.6.4
CVE-2017-14766Sep 21, 2017
Medium6.1
Reflected Cross-Site Scripting
2kb Amazon Affiliates Store
<2.1.1Update to 2.1.1
CVE-2017-14622Sep 20, 2017
Medium4.3
Directory Traversal during unzip
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14719Sep 19, 2017
Critical9.8
SQL Injection via Mishandled Placeholders
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14723Sep 19, 2017
Low3.5
Open Redirect in Admin Dashboard
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14725Sep 19, 2017
Medium5.5
Stored Cross-Site Scripting via Plugin Names
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14721Sep 19, 2017
Medium6.4
Cross-Site Scripting via Javascript: and Data: URLs
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14718Sep 19, 2017
Medium6.4
Cross-Site Scripting via Shortcodes
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14726Sep 19, 2017
Medium4.9
Directory Traversal via Customizer
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14722Sep 19, 2017
Medium6.4
Cross-Site Scripting via Template Name
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14720Sep 19, 2017
Medium6.4
Cross-Site Scripting in oEmbed
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14724Sep 19, 2017
Critical9.8
PHP Object Injection
Post Pay Counter
<2.731Update to 2.731
CVE-2017-18583Sep 16, 2017