CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 1320)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.4 | Missing Authorization | CVE-2018-20155 | — | |
| Medium4.3 | Authenticated Information Disclosure | CVE-2018-20154 | — | |
| Critical9.1 | Directory Traversal | CVE-2016-10965 | — | |
| High7.5 | File Upload to User Controlled Location | CVE-2016-10966 | — | |
| High7.5 | Arbitrary File Upload | CVE-2016-10929 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10967 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10961 | — | |
| Critical9.8 | Authentication Bypass | CVE-2016-10971 | — | |
| Medium6.1 | Cross-Site Scripting via a ticket excerpt. | CVE-2016-10970 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-4827 | — | |
| Critical9.8 | Authentication Bypass | CVE-2016-4828 | — | |
| High8.1 | Object Injection | CVE-2016-4825 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-4826 | — | |
| Critical9.8 | Remote File Upload | CVE-2016-1000112 | — | |
| High8.8 | Privilege Escalation | CVE-2016-10968 | — | |
| High7.2 | Stored Cross-Site Scripting via discussion ticket title | CVE-2016-10969 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10705 | — | |
| Medium4.3 | Revision History Disclosure WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5835 | — | |
| Medium5.5 | Cross-Site Scripting via Customizer WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5832 | — | |
| Medium5.3 | Denial of Service via oEmbed Protocol WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5836 | — | |
| High7.3 | Bypass sanitize_file_name Protection WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5839 | — | |
| Medium6.4 | Cross-Site Scripting via Attachment Name WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5834 | — | |
| Medium5.4 | Authorization Bypass to Remove Category Attribute WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5837 | — | |
| Medium5.3 | Password Change via Stolen Cookie WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5838 | — | |
| Medium6.4 | Cross-Site Scripting via Attachment Name #2 WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5833 | — | |
| Critical9.8 | SQL Injection | CVE-2016-10917 | — | |
| Critical9.6 | Remote Code Execution | CVE-2016-20010 | — | |
| Medium6.5 | News & WooCommerce WordPress Theme < 6.7.2 - Cross-Site Scripting | CVE-2017-18634 | — | |
| Critical9.8 | News & WooCommerce WordPress Theme <= 6.7 - Arbitrary Options Update | CVE-2016-10972 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2016-15043 | — |
- Medium5.4Missing Authorization
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<2.0.7Update to 2.0.7
- Medium4.3Authenticated Information Disclosure
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<2.0.7Update to 2.0.7
- Critical9.1Directory Traversal
Real3D Flipbook
≤1.0.0No patch available
- High7.5File Upload to User Controlled Location
Real3D Flipbook
≤1.0.0No patch available
- High7.5Arbitrary File Upload
Advanced AJAX Page Loader
<2.7.7Update to 2.7.7
- Medium6.1Reflected Cross-Site Scripting
Real3D Flipbook
≤1.0.0No patch available
- Medium6.1Cross-Site Scripting
ColorWay
≤3.4.1Update to 3.4.2
- Critical9.8Authentication Bypass
MemberSonic Lite Membership Site Plugin
≤1.2Update to 1.302
- Medium6.1Cross-Site Scripting via a ticket excerpt.
SupportFlow
<0.7Update to 0.7
- Medium6.1Cross-Site Scripting
Welcart e-Commerce
≤1.8.2Update to 1.8.3
- Critical9.8Authentication Bypass
Welcart e-Commerce
≤1.8.2Update to 1.8.3
- High8.1Object Injection
Welcart e-Commerce
<1.8.3Update to 1.8.3
- Medium6.1Reflected Cross-Site Scripting
Welcart e-Commerce
<1.8.3Update to 1.8.3
- Critical9.8Remote File Upload
contus-video-comments
≤1.0No patch available
- High8.8Privilege Escalation
Community by PeepSo – Download from PeepSo.com
≤1.6.0Update to 1.6.1
- High7.2Stored Cross-Site Scripting via discussion ticket title
SupportFlow
≤0.6Update to 0.7
- Medium6.1Cross-Site Scripting
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<4.0.4Update to 4.0.4
- Medium4.3Revision History Disclosure
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium5.5Cross-Site Scripting via Customizer
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium5.3Denial of Service via oEmbed Protocol
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- High7.3Bypass sanitize_file_name Protection
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium6.4Cross-Site Scripting via Attachment Name
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium5.4Authorization Bypass to Remove Category Attribute
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium5.3Password Change via Stolen Cookie
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium6.4Cross-Site Scripting via Attachment Name #2
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Critical9.8SQL Injection
Search Everything
<8.1.6Update to 8.1.6
- Critical9.6Remote Code Execution
EWWW Image Optimizer
≤2.8.4Update to 2.8.5
- Medium6.5News & WooCommerce WordPress Theme < 6.7.2 - Cross-Site Scripting
Newspaper - News & WooCommerce WordPress Theme
<6.7.2Update to 6.7.2
- Critical9.8News & WooCommerce WordPress Theme <= 6.7 - Arbitrary Options Update
Newspaper - News & WooCommerce WordPress Theme
≤6.7.1Update to 6.7.2
- Critical9.8Arbitrary File Upload
WP Mobile Detector
≤3.5Update to 3.6