CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 1321)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 1321)
Severity	Vulnerability	CVE	Installs	Published
Critical9.8	SQL Injection Kento Post View Counter≤2.8No patch available	CVE-2016-15040	—	May 26, 2016
Medium6.1	Stored Cross-Site Scripting Markdown on Save Improved≤2.5No patch available	CVE-2017-9337	—	May 25, 2016
Medium6.1	Stored Cross-Site Scripting Markdown on Save Improved≤2.5Update to 2.5.1	CVE-2016-4812	—	May 25, 2016
Medium6.1	Reflected Cross-Site Scripting Brafton<3.4.8Update to 3.4.8	CVE-2016-10973	—	May 20, 2016
High8.8	Cross-Site Request Forgery Fluid Responsive Slideshow<2.2.7Update to 2.2.7	CVE-2016-10974	—	May 18, 2016
Medium6.1	Reflected Cross-Site Scripting Fluid Responsive Slideshow<2.2.7Update to 2.2.7	CVE-2016-10975	—	May 18, 2016
High8.1	2.9.42 - PHP Object Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder2.9.36 – 2.9.42Update to 2.9.42.1	CVE-2016-1209	—	May 13, 2016
High8.8	Cross-Site Request Forgery WP Editor<1.2.6Update to 1.2.6	CVE-2016-10885	—	May 13, 2016
Medium6.5	Directory Traversal Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization≤4.4.4Update to 4.5.0	CVE-2016-10977	—	May 10, 2016
Critical9.8	SQL Injection Image Gallery - Responsive Photo Gallery≤1.8.9Update to 1.9.0	CVE-2016-11018	—	May 10, 2016
Medium6.1	Cross-Site Scripting Crayon Syntax Highlighter<2.8.4Update to 2.8.4	CVE-2016-10893	—	May 10, 2016
Medium6.4	Authenticated Stored Cross-Site Scripting Royal PrettyPhoto≤1.2Update to 1.3	CVE-2015-10128	—	May 9, 2016
High7.2	Cross-Site Scripting Safe Editor<1.2Update to 1.2	CVE-2016-10976	—	May 6, 2016
Medium6.4	Cross-Site Scripting via MediaElement.js WordPress≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2	CVE-2016-4567	—	May 6, 2016
Medium6.1	Cross-Site Scripting via plupload.flash.swf WordPress≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2	CVE-2016-4566	—	May 6, 2016
Medium6.1	Reflected Cross-Site Scripting Truemagall versionsNo patch available	CVE-2016-10994	—	Apr 29, 2016
High7.2	Stored Cross-Site Scripting MainWP Dashboard: Self-hosted WordPress Management for Agencies<3.1.3Update to 3.1.3	CVE-2016-15041	—	Apr 29, 2016
High7.5	Missing Authorization Checks Ghost≤0.5.5Update to 0.5.6	CVE-2016-10983	—	Apr 28, 2016
Medium6.1	Cross-Site Scripting GNUCommerce<0.5.7-betaUpdate to 0.5.7-beta	CVE-2016-10920	—	Apr 26, 2016
Medium6.1	Multiple Cross-Site Scripting Sermon Browser≤0.45.15Update to 0.45.16	CVE-2016-10897	—	Apr 26, 2016
Critical9.8	Arbitrary File Upload Tevolution<2.3.0Update to 2.3.0	CVE-2016-10995	—	Apr 23, 2016
Medium6.1	Reflected Cross-Site Scripting Echo Sign<1.2Update to 1.2	CVE-2016-10984	—	Apr 21, 2016
Medium6.1	Reflected Cross-Site Scripting Tweet Wheel<1.0.3.3Update to 1.0.3.3	CVE-2016-10986	—	Apr 21, 2016
Medium6.1	Reflected Cross-Site Scripting Echo Sign<1.2Update to 1.2	CVE-2016-10985	—	Apr 21, 2016
Medium6.1	Cross-Site Scripting افزونه پیامک ووکامرس \| Persian WooCommerce SMS≤3.3.2Update to 3.3.3	CVE-2016-10987	—	Apr 21, 2016
Medium6.1	Cross-Site Scripting Translate WordPress – Google Language Translator<5.0.06Update to 5.0.06	CVE-2016-10870	—	Apr 18, 2016
Medium5.4	Stored Cross-Site Scripting leenk.me<2.6.0Update to 2.6.0	CVE-2016-10988	—	Apr 17, 2016
Medium6.1	Stored Cross-Site Scripting Kento Post View Counter≤2.8No patch available	CVE-2016-10981	—	Apr 17, 2016
High8.8	Cross-Site Request Forgery Kento Post View Counter≤2.8No patch available	CVE-2016-10982	—	Apr 17, 2016
Medium6.1	Reflected Cross-Site Scripting Kento Post View Counter≤2.8No patch available	CVE-2016-10980	—	Apr 16, 2016

Critical9.8
SQL Injection
Kento Post View Counter
≤2.8No patch available
CVE-2016-15040May 26, 2016
Medium6.1
Stored Cross-Site Scripting
Markdown on Save Improved
≤2.5No patch available
CVE-2017-9337May 25, 2016
Medium6.1
Stored Cross-Site Scripting
Markdown on Save Improved
≤2.5Update to 2.5.1
CVE-2016-4812May 25, 2016
Medium6.1
Reflected Cross-Site Scripting
Brafton
<3.4.8Update to 3.4.8
CVE-2016-10973May 20, 2016
High8.8
Cross-Site Request Forgery
Fluid Responsive Slideshow
<2.2.7Update to 2.2.7
CVE-2016-10974May 18, 2016
Medium6.1
Reflected Cross-Site Scripting
Fluid Responsive Slideshow
<2.2.7Update to 2.2.7
CVE-2016-10975May 18, 2016
High8.1
2.9.42 - PHP Object Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
2.9.36 – 2.9.42Update to 2.9.42.1
CVE-2016-1209May 13, 2016
High8.8
Cross-Site Request Forgery
WP Editor
<1.2.6Update to 1.2.6
CVE-2016-10885May 13, 2016
Medium6.5
Directory Traversal
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
≤4.4.4Update to 4.5.0
CVE-2016-10977May 10, 2016
Critical9.8
SQL Injection
Image Gallery - Responsive Photo Gallery
≤1.8.9Update to 1.9.0
CVE-2016-11018May 10, 2016
Medium6.1
Cross-Site Scripting
Crayon Syntax Highlighter
<2.8.4Update to 2.8.4
CVE-2016-10893May 10, 2016
Medium6.4
Authenticated Stored Cross-Site Scripting
Royal PrettyPhoto
≤1.2Update to 1.3
CVE-2015-10128May 9, 2016
High7.2
Cross-Site Scripting
Safe Editor
<1.2Update to 1.2
CVE-2016-10976May 6, 2016
Medium6.4
Cross-Site Scripting via MediaElement.js
WordPress
≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2
CVE-2016-4567May 6, 2016
Medium6.1
Cross-Site Scripting via plupload.flash.swf
WordPress
≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2
CVE-2016-4566May 6, 2016
Medium6.1
Reflected Cross-Site Scripting
Truemag
all versionsNo patch available
CVE-2016-10994Apr 29, 2016
High7.2
Stored Cross-Site Scripting
MainWP Dashboard: Self-hosted WordPress Management for Agencies
<3.1.3Update to 3.1.3
CVE-2016-15041Apr 29, 2016
High7.5
Missing Authorization Checks
Ghost
≤0.5.5Update to 0.5.6
CVE-2016-10983Apr 28, 2016
Medium6.1
Cross-Site Scripting
GNUCommerce
<0.5.7-betaUpdate to 0.5.7-beta
CVE-2016-10920Apr 26, 2016
Medium6.1
Multiple Cross-Site Scripting
Sermon Browser
≤0.45.15Update to 0.45.16
CVE-2016-10897Apr 26, 2016
Critical9.8
Arbitrary File Upload
Tevolution
<2.3.0Update to 2.3.0
CVE-2016-10995Apr 23, 2016
Medium6.1
Reflected Cross-Site Scripting
Echo Sign
<1.2Update to 1.2
CVE-2016-10984Apr 21, 2016
Medium6.1
Reflected Cross-Site Scripting
Tweet Wheel
<1.0.3.3Update to 1.0.3.3
CVE-2016-10986Apr 21, 2016
Medium6.1
Reflected Cross-Site Scripting
Echo Sign
<1.2Update to 1.2
CVE-2016-10985Apr 21, 2016
Medium6.1
Cross-Site Scripting
افزونه پیامک ووکامرس | Persian WooCommerce SMS
≤3.3.2Update to 3.3.3
CVE-2016-10987Apr 21, 2016
Medium6.1
Cross-Site Scripting
Translate WordPress – Google Language Translator
<5.0.06Update to 5.0.06
CVE-2016-10870Apr 18, 2016
Medium5.4
Stored Cross-Site Scripting
leenk.me
<2.6.0Update to 2.6.0
CVE-2016-10988Apr 17, 2016
Medium6.1
Stored Cross-Site Scripting
Kento Post View Counter
≤2.8No patch available
CVE-2016-10981Apr 17, 2016
High8.8
Cross-Site Request Forgery
Kento Post View Counter
≤2.8No patch available
CVE-2016-10982Apr 17, 2016
Medium6.1
Reflected Cross-Site Scripting
Kento Post View Counter
≤2.8No patch available
CVE-2016-10980Apr 16, 2016