CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 131)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
Aruba HiSpeed Cache
≤3.0.14Update to 3.0.15
- Medium6.1Reflected Cross-Site Scripting
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.46Update to 1.15.47
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta Field
Easy Google Fonts
≤2.0.4No patch available
- Medium4.3Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via 'import_cf7_id'
Advanced Contact form 7 DB
≤2.1.3No patch available
- Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter
WP BackItUp Community Edition
≤2.1.0No patch available
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter
Builderall for WordPress
≤3.0.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting
Builderall for WordPress
≤3.0.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting
Builderall for WordPress
≤3.0.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via 'sbm_description' Parameter
Sidebar Manager Light
≤1.18No patch available
- High8.0Authenticated (Subscriber+) Arbitrary Password Reset
Bulk Password Reset
≤1.3.3No patch available
- High7.5Unauthenticated Arbitrary File Read via 'file_id' Path Segment
Direct Download for WooCommerce
≤1.19No patch available
- Critical9.8Unauthenticated Arbitrary File Upload via 'type' Parameter
Drag and Drop File Upload for Elementor Forms
≤1.6.0Update to 1.6.1
- High7.5Unauthenticated SQL Injection
Verified Reviews (Avis Vérifiés)
≤2.4.6No patch available
- High8.8Authenticated (Subscriber+) Remote Code Execution
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress
≤4.1224Update to 4.1225
- Medium5.3Unauthenticated Email Header Injection
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
<4.1.9Update to 4.1.9
- Medium5.3Missing Authorization
WP Fast Total Search – The Power of Indexed Search
≤1.82.284Update to 1.83.286
- Medium5.36.2.5 - Unauthenticated Information Exposure
Kirki – Freeform Page Builder, Website Builder & Customizer
6.2.1 – 6.2.5Update to 6.3.0
- Medium5.32.3.3 - Unauthenticated Information Exposure
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
1.3.1 – 2.3.3Update to 3.4.0
- Medium5.3Missing Authorization
BuddyForms
≤2.9.0No patch available
- Medium5.33.5.2 - Unauthenticated Information Exposure
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
3.3.6 – 3.5.2Update to 3.5.3
- Medium5.3Missing Authorization
Robokassa payment gateway for Woocommerce
≤1.8.9Update to 1.9.0
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Advanced Customized Prompts
≤1.0.1No patch available
- Medium5.3Unauthenticated Information Exposure
Teddy Bear Customize Addon
≤1.0.5No patch available
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Teddy Bear Customize Addon
≤1.0.5No patch available
- Medium6.41.8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Content Mask
1.7.1 – 1.8.5.5Update to 1.8.5.6
- Medium5.32.8.1 - Payment Bypass to Unauthenticated Unauthorized Order Completion
المنتور فارسی
2.7.10 – 2.8.1Update to 2.8.2
- High7.2Unauthenticated Stored Cross-Site Scripting
WPCS – WordPress Currency Switcher Professional
≤1.3.2Update to 1.3.3
- Medium5.3IP Soofing
IP2Location Country Blocker
≤2.44.0Update to 2.45.0
- High7.3Unauthenticated Privilege Escalation
SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP
≤2.1.5Update to 2.1.6
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Docs
≤2.3.3Update to 2.3.4