CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 1323)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 1323)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Cross-Site Scripting All-In-One Security (AIOS) – Security and Firewall<4.0.6Update to 4.0.6	CVE-2016-10867	—	Feb 23, 2016
Medium6.1	Cross-Site Scripting All-In-One Security (AIOS) – Security and Firewall<4.0.5Update to 4.0.5	CVE-2016-10868	—	Feb 22, 2016
High8.8	Sensitive Information Disclosure Bloom Email Opt-In<1.1.0Update to 1.1.1	CVE-2016-11003	—	Feb 18, 2016
High8.8	Privilege Escalation Divi Extra≤1.2.3Update to 1.2.4	CVE-2016-11002	—	Feb 18, 2016
High8.8	Privilege Escalation Bloom Email Opt-In≤1.1.0Update to 1.1.1	CVE-2016-11004	—	Feb 17, 2016
High7.2	Multiple Vulnerabilities mb.miniAudioPlayer – an HTML5 audio player for your mp3 files≤1.7.6No patch available	CVE-2016-0796	—	Feb 12, 2016
High8.8	Privilege Escalation Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools≤1.5.7Update to 1.5.8	CVE-2016-10923	—	Feb 10, 2016
High7.2	Reflected Cross-Site Scripting User Submitted Posts – Enable Users to Submit Posts from the Front End<20160215Update to 20160215	CVE-2016-11001	—	Feb 10, 2016
Critical9.8	Missing Authorization Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers<1.8.4Update to 1.8.4	CVE-2016-10935	—	Feb 10, 2016
Medium6.1	Cross-Site Scripting Recipes Writer≤1.0.4No patch available	CVE-2016-1000147	—	Feb 9, 2016
Medium6.1	Cross-Site Scripting Easy Contact Form Builder≤1.0Update to 1.1	CVE-2016-1000152	—	Feb 9, 2016
Medium6.1	Reflected Cross-Site Scripting Pondol Form to Mail≤1.1No patch available	CVE-2016-1000146	—	Feb 9, 2016
Medium6.1	Reflected Cross-Site Scripting ajax-random-post≤2.00No patch available	CVE-2016-1000127	—	Feb 9, 2016
Medium6.1	Reflected Cross-Site Scripting via title_az parameter E-Search≤1.0No patch available	CVE-2016-1000130	—	Feb 9, 2016
Medium6.1	Reflected Cross-Site Scripting PhotoXhibit≤2.1.8No patch available	CVE-2016-1000144	—	Feb 9, 2016
Medium6.1	Reflected Cross-Site Scripting new-year-firework≤1.1.9No patch available	CVE-2016-1000140	—	Feb 9, 2016
Medium6.1	Reflected Cross-Site Scripting Admin Font Editor<1.8Update to 1.8	CVE-2016-1000126	—	Feb 9, 2016
Medium6.1	Reflected Cross-Site Scripting anti-plagiarism≤3.60No patch available	CVE-2016-1000128	—	Feb 9, 2016
Medium6.1	Reflected Cross-Site Scripting heat-trackr<1.01Update to 1.01	CVE-2016-1000136	—	Feb 9, 2016
Medium6.1	Reflected Cross-Site Scripting Simplified Content<1.0.1Update to 1.0.1	CVE-2016-1000150	—	Feb 9, 2016
Critical9.8	Blind SQL Injection Booking Calendar Contact Form<1.0.24Update to 1.0.24	CVE-2016-10909	—	Feb 8, 2016
High8.1	Shortcode SQL Injection Booking Calendar Contact Form≤1.0.23Update to 1.0.24	CVE-2016-20068	—	Feb 8, 2016
Medium6.1	Reflected Cross-Site Scripting Booking Calendar Contact Form≤1.0.23Update to 1.0.24	CVE-2016-10908	—	Feb 8, 2016
High8.8	Missing Authorization Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools≤1.5.6Update to 1.5.7	CVE-2016-10922	—	Feb 8, 2016
Medium6.1	Reflected Cross-Site Scripting Elfsight Instagram Widget – Instagram Gallery<1.1.2Update to 1.1.2	CVE-2016-11005	—	Feb 7, 2016
Medium6.4	Cross-Site Scripting Universal Analytics≤1.3.0Update to 1.3.1	CVE-2016-10912	—	Feb 4, 2016
Medium6.5	Unauthorized Settings Change WP-Invoice – Web Invoice and Billing≤4.1.0Update to 4.1.1	CVE-2016-11006	—	Feb 3, 2016
Medium5.3	Missing Authorization WP-Invoice – Web Invoice and Billing<4.1.1Update to 4.1.1	CVE-2016-11009	—	Feb 3, 2016
Medium5.3	Missing Authorization WP-Invoice – Web Invoice and Billing≤4.1.0Update to 4.1.1	CVE-2016-11010	—	Feb 3, 2016
Medium5.3	Insecure Direct Object Reference WP-Invoice – Web Invoice and Billing≤4.1.0Update to 4.1.1	CVE-2016-11007	—	Feb 3, 2016

Medium6.1
Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
<4.0.6Update to 4.0.6
CVE-2016-10867Feb 23, 2016
Medium6.1
Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
<4.0.5Update to 4.0.5
CVE-2016-10868Feb 22, 2016
High8.8
Sensitive Information Disclosure
Bloom Email Opt-In
<1.1.0Update to 1.1.1
CVE-2016-11003Feb 18, 2016
High8.8
Privilege Escalation
Divi Extra
≤1.2.3Update to 1.2.4
CVE-2016-11002Feb 18, 2016
High8.8
Privilege Escalation
Bloom Email Opt-In
≤1.1.0Update to 1.1.1
CVE-2016-11004Feb 17, 2016
High7.2
Multiple Vulnerabilities
mb.miniAudioPlayer – an HTML5 audio player for your mp3 files
≤1.7.6No patch available
CVE-2016-0796Feb 12, 2016
High8.8
Privilege Escalation
Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools
≤1.5.7Update to 1.5.8
CVE-2016-10923Feb 10, 2016
High7.2
Reflected Cross-Site Scripting
User Submitted Posts – Enable Users to Submit Posts from the Front End
<20160215Update to 20160215
CVE-2016-11001Feb 10, 2016
Critical9.8
Missing Authorization
Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers
<1.8.4Update to 1.8.4
CVE-2016-10935Feb 10, 2016
Medium6.1
Cross-Site Scripting
Recipes Writer
≤1.0.4No patch available
CVE-2016-1000147Feb 9, 2016
Medium6.1
Cross-Site Scripting
Easy Contact Form Builder
≤1.0Update to 1.1
CVE-2016-1000152Feb 9, 2016
Medium6.1
Reflected Cross-Site Scripting
Pondol Form to Mail
≤1.1No patch available
CVE-2016-1000146Feb 9, 2016
Medium6.1
Reflected Cross-Site Scripting
ajax-random-post
≤2.00No patch available
CVE-2016-1000127Feb 9, 2016
Medium6.1
Reflected Cross-Site Scripting via title_az parameter
E-Search
≤1.0No patch available
CVE-2016-1000130Feb 9, 2016
Medium6.1
Reflected Cross-Site Scripting
PhotoXhibit
≤2.1.8No patch available
CVE-2016-1000144Feb 9, 2016
Medium6.1
Reflected Cross-Site Scripting
new-year-firework
≤1.1.9No patch available
CVE-2016-1000140Feb 9, 2016
Medium6.1
Reflected Cross-Site Scripting
Admin Font Editor
<1.8Update to 1.8
CVE-2016-1000126Feb 9, 2016
Medium6.1
Reflected Cross-Site Scripting
anti-plagiarism
≤3.60No patch available
CVE-2016-1000128Feb 9, 2016
Medium6.1
Reflected Cross-Site Scripting
heat-trackr
<1.01Update to 1.01
CVE-2016-1000136Feb 9, 2016
Medium6.1
Reflected Cross-Site Scripting
Simplified Content
<1.0.1Update to 1.0.1
CVE-2016-1000150Feb 9, 2016
Critical9.8
Blind SQL Injection
Booking Calendar Contact Form
<1.0.24Update to 1.0.24
CVE-2016-10909Feb 8, 2016
High8.1
Shortcode SQL Injection
Booking Calendar Contact Form
≤1.0.23Update to 1.0.24
CVE-2016-20068Feb 8, 2016
Medium6.1
Reflected Cross-Site Scripting
Booking Calendar Contact Form
≤1.0.23Update to 1.0.24
CVE-2016-10908Feb 8, 2016
High8.8
Missing Authorization
Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools
≤1.5.6Update to 1.5.7
CVE-2016-10922Feb 8, 2016
Medium6.1
Reflected Cross-Site Scripting
Elfsight Instagram Widget – Instagram Gallery
<1.1.2Update to 1.1.2
CVE-2016-11005Feb 7, 2016
Medium6.4
Cross-Site Scripting
Universal Analytics
≤1.3.0Update to 1.3.1
CVE-2016-10912Feb 4, 2016
Medium6.5
Unauthorized Settings Change
WP-Invoice – Web Invoice and Billing
≤4.1.0Update to 4.1.1
CVE-2016-11006Feb 3, 2016
Medium5.3
Missing Authorization
WP-Invoice – Web Invoice and Billing
<4.1.1Update to 4.1.1
CVE-2016-11009Feb 3, 2016
Medium5.3
Missing Authorization
WP-Invoice – Web Invoice and Billing
≤4.1.0Update to 4.1.1
CVE-2016-11010Feb 3, 2016
Medium5.3
Insecure Direct Object Reference
WP-Invoice – Web Invoice and Billing
≤4.1.0Update to 4.1.1
CVE-2016-11007Feb 3, 2016