CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 1312)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 1312)
Severity	Vulnerability	CVE	Installs	Published
High7.5	Directory Traversal Task Scheduler≤1.6.0Update to 1.6.1	CVE-2017-1000170	—	May 8, 2017
Medium5.9	Unauthorized Password Reset via Interception WordPress<5.5Update to 5.5	CVE-2017-8295	—	May 3, 2017
Medium6.1	Cross-Site Scripting cformsII≤14.13.2Update to 14.13.3	CVE-2017-18559	—	Apr 28, 2017
Critical9.8	Object Injection Gravitate QA Tracker≤1.2.1No patch available	CVE-2017-18605	—	Apr 27, 2017
Critical9.8	PHP Object Injection SiteBuilder Dynamic Components≤1.0No patch available	CVE-2017-18604	—	Apr 27, 2017
Medium6.1	Cross-Site Scripting Jetpack – AI Agents & MCP, Security, Backup & Analytics<4.0.3Update to 4.0.3	CVE-2016-10706	—	Apr 26, 2017
Critical9.8	Arbitrary file upload flickr-picture-backup≤0.7No patch available	CVE-2017-1002016	—	Apr 26, 2017
Medium6.1	Stored Cross-Site Scripting Avada \| Website Builder For WordPress & WooCommerce<5.1.5Update to 5.1.5	CVE-2017-18606	—	Apr 26, 2017
High8.8	Cross-Site Request Forgery Avada \| Website Builder For WordPress & WooCommerce<5.1.5Update to 5.1.5	CVE-2017-18607	—	Apr 26, 2017
High7.2	Authenticated SQL Injection cformsII<14.13Update to 14.13	CVE-2017-18570	—	Apr 24, 2017
Critical9.8	Arbitrary File Upload CatalogX Product Catalog, Product Enquiry & Quotes for WooCommerce≤3.0.5Update to 3.1.0	CVE-2017-18592	—	Apr 20, 2017
Medium6.1	Reflected Cross-Site Scripting Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred<1.7.8Update to 1.7.8	CVE-2017-20008	—	Apr 20, 2017
Medium6.1	Reflected Cross-Site Scripting Simple Job Board<2.4.4Update to 2.4.4	CVE-2017-18498	—	Apr 19, 2017
Medium6.1	Cross-Site Scripting Spot.IM Comments<4.0.4Update to 4.0.4	CVE-2017-18608	—	Apr 19, 2017
Medium6.1	Reflected Cross-Site Scripting Realty by BestWebSoft<1.1.0Update to 1.1.0	CVE-2017-18532	—	Apr 17, 2017
Medium6.1	Reflected Cross-Site Scripting Social Buttons Pack by BestWebSoft<1.1.1Update to 1.1.1	CVE-2017-18500	—	Apr 17, 2017
Medium6.1	Cross-Site Scripting BestWebSoft's LinkedIn<1.0.5Update to 1.0.5	CVE-2017-18516	—	Apr 17, 2017
Medium6.1	Reflected Cross-Site Scripting Timesheet by BestWebSoft<0.1.5Update to 0.1.5	CVE-2017-18590	—	Apr 17, 2017
Medium6.1	Reflected Cross-Site Scripting Error Log Viewer by BestWebSoft<1.0.6Update to 1.0.6	CVE-2017-18562	—	Apr 17, 2017
Medium6.1	Reflected Cross-Site Scripting Rating by BestWebSoft<0.2Update to 0.2	CVE-2017-18530	—	Apr 17, 2017
Medium6.1	Reflected Cross-Site Scripting PromoBar by BestWebSoft – Customizable Advertisement Banner for WordPress Website<1.1.1Update to 1.1.1	CVE-2017-18529	—	Apr 17, 2017
Medium6.1	Cross-Site Scripting Rimons Twitter Widget≤1.2.4Update to 1.3	CVE-2017-18533	—	Apr 16, 2017
Medium6.1	Reflected Cross-Site Scripting Htaccess by BestWebSoft – WordPress Website Access Control Plugin<1.7.6Update to 1.7.6	CVE-2017-18496	—	Apr 14, 2017
Medium6.1	Cross-Site Scripting Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more<1.2.5Update to 1.2.5	CVE-2017-7723	—	Apr 14, 2017
Medium6.1	Cross-Site Scripting PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin<1.9.4Update to 1.9.4	CVE-2017-18528	—	Apr 14, 2017
Medium6.1	Stored Cross-Site Scripting WP Statistics – Simple, privacy-friendly Google Analytics alternative≤12.0.4Update to 12.0.5	CVE-2017-2136	—	Apr 13, 2017
Medium6.1	Reflected Cross-Site Scripting Testimonials by BestWebSoft≤0.1.8Update to 0.1.9	CVE-2017-18558	—	Apr 12, 2017
Medium6.1	Reflected Cross-Site Scripting BestWebSoft’s Pinterest≤1.0.4Update to 1.0.5	CVE-2017-18517	—	Apr 12, 2017
Medium6.1	Reflected Cross-Site Scripting Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress<4.0.6Update to 4.0.6	CVE-2017-18491	—	Apr 12, 2017
Medium6.1	Multiple Cross-Site Scripting Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress≤1.5.6Update to 1.5.7	CVE-2017-18492	—	Apr 12, 2017

High7.5
Directory Traversal
Task Scheduler
≤1.6.0Update to 1.6.1
CVE-2017-1000170May 8, 2017
Medium5.9
Unauthorized Password Reset via Interception
WordPress
<5.5Update to 5.5
CVE-2017-8295May 3, 2017
Medium6.1
Cross-Site Scripting
cformsII
≤14.13.2Update to 14.13.3
CVE-2017-18559Apr 28, 2017
Critical9.8
Object Injection
Gravitate QA Tracker
≤1.2.1No patch available
CVE-2017-18605Apr 27, 2017
Critical9.8
PHP Object Injection
SiteBuilder Dynamic Components
≤1.0No patch available
CVE-2017-18604Apr 27, 2017
Medium6.1
Cross-Site Scripting
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<4.0.3Update to 4.0.3
CVE-2016-10706Apr 26, 2017
Critical9.8
Arbitrary file upload
flickr-picture-backup
≤0.7No patch available
CVE-2017-1002016Apr 26, 2017
Medium6.1
Stored Cross-Site Scripting
Avada | Website Builder For WordPress & WooCommerce
<5.1.5Update to 5.1.5
CVE-2017-18606Apr 26, 2017
High8.8
Cross-Site Request Forgery
Avada | Website Builder For WordPress & WooCommerce
<5.1.5Update to 5.1.5
CVE-2017-18607Apr 26, 2017
High7.2
Authenticated SQL Injection
cformsII
<14.13Update to 14.13
CVE-2017-18570Apr 24, 2017
Critical9.8
Arbitrary File Upload
CatalogX Product Catalog, Product Enquiry & Quotes for WooCommerce
≤3.0.5Update to 3.1.0
CVE-2017-18592Apr 20, 2017
Medium6.1
Reflected Cross-Site Scripting
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
<1.7.8Update to 1.7.8
CVE-2017-20008Apr 20, 2017
Medium6.1
Reflected Cross-Site Scripting
Simple Job Board
<2.4.4Update to 2.4.4
CVE-2017-18498Apr 19, 2017
Medium6.1
Cross-Site Scripting
Spot.IM Comments
<4.0.4Update to 4.0.4
CVE-2017-18608Apr 19, 2017
Medium6.1
Reflected Cross-Site Scripting
Realty by BestWebSoft
<1.1.0Update to 1.1.0
CVE-2017-18532Apr 17, 2017
Medium6.1
Reflected Cross-Site Scripting
Social Buttons Pack by BestWebSoft
<1.1.1Update to 1.1.1
CVE-2017-18500Apr 17, 2017
Medium6.1
Cross-Site Scripting
BestWebSoft's LinkedIn
<1.0.5Update to 1.0.5
CVE-2017-18516Apr 17, 2017
Medium6.1
Reflected Cross-Site Scripting
Timesheet by BestWebSoft
<0.1.5Update to 0.1.5
CVE-2017-18590Apr 17, 2017
Medium6.1
Reflected Cross-Site Scripting
Error Log Viewer by BestWebSoft
<1.0.6Update to 1.0.6
CVE-2017-18562Apr 17, 2017
Medium6.1
Reflected Cross-Site Scripting
Rating by BestWebSoft
<0.2Update to 0.2
CVE-2017-18530Apr 17, 2017
Medium6.1
Reflected Cross-Site Scripting
PromoBar by BestWebSoft – Customizable Advertisement Banner for WordPress Website
<1.1.1Update to 1.1.1
CVE-2017-18529Apr 17, 2017
Medium6.1
Cross-Site Scripting
Rimons Twitter Widget
≤1.2.4Update to 1.3
CVE-2017-18533Apr 16, 2017
Medium6.1
Reflected Cross-Site Scripting
Htaccess by BestWebSoft – WordPress Website Access Control Plugin
<1.7.6Update to 1.7.6
CVE-2017-18496Apr 14, 2017
Medium6.1
Cross-Site Scripting
Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more
<1.2.5Update to 1.2.5
CVE-2017-7723Apr 14, 2017
Medium6.1
Cross-Site Scripting
PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin
<1.9.4Update to 1.9.4
CVE-2017-18528Apr 14, 2017
Medium6.1
Stored Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤12.0.4Update to 12.0.5
CVE-2017-2136Apr 13, 2017
Medium6.1
Reflected Cross-Site Scripting
Testimonials by BestWebSoft
≤0.1.8Update to 0.1.9
CVE-2017-18558Apr 12, 2017
Medium6.1
Reflected Cross-Site Scripting
BestWebSoft’s Pinterest
≤1.0.4Update to 1.0.5
CVE-2017-18517Apr 12, 2017
Medium6.1
Reflected Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
<4.0.6Update to 4.0.6
CVE-2017-18491Apr 12, 2017
Medium6.1
Multiple Cross-Site Scripting
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress
≤1.5.6Update to 1.5.7
CVE-2017-18492Apr 12, 2017