CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 1324)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
WP-Invoice – Web Invoice and Billing
<4.1.1Update to 4.1.1
- High8.8Privilege Escalation
WP-Invoice – Web Invoice and Billing
<4.1.1Update to 4.1.1
- Medium6.1Multiple Cross-Site Scripting
eShop
≤6.3.14No patch available
- High8.8Cross-Site Request Forgery
Simple add pages or posts
<1.7Update to 1.7
- Medium5.4Open Redirect via wp_validate_redirect
WordPress
≤4.4.1Update to 3.7.13 or 3.8.13 or 3.9.11 or 4.0.10 or 4.1.10 or 4.2.7 or 4.3.3 or 4.4.2
- High8.8Multiple SQL Injections
eShop
≤6.3.14No patch available
- Medium6.4Server-Side Request Forgery
WordPress
≤4.4.1Update to 3.7.13 or 3.8.13 or 3.9.11 or 4.0.10 or 4.1.10 or 4.2.7 or 4.3.3 or 4.4.2
- Medium6.1Cross-Site Scripting
Connections Business Directory
<8.5.9Update to 8.5.9
- Medium6.4Cross-Site Scripting
Sola Support Tickets
<3.13Update to 3.13
- Medium6.1Reflected Cross-Site Scripting
IMPress Listings
≤2.0.1Update to 2.0.2
- High8.8SQL Injection
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤1.07.11Update to 2.0
- Critical9.8SQL Injection
Appointment Booking Calendar
<1.1.24Update to 1.1.24
- High7.5Authentication Bypass
OneLogin SAML SSO
<2.2.0Update to 2.2.0
- Medium5.5Cross-Site Scripting via Theme Names
WordPress
≤4.4Update to 3.7.12 or 3.8.12 or 3.9.10 or 4.0.9 or 4.1.9 or 4.2.6 or 4.3.2 or 4.4.1
- Medium5.3Remote Code Execution
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation
<1.1.4.6Update to 1.1.4.6
- High8.8Unrestricted File Upload
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.10Update to 2.1.15
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
mTouch Quiz
<3.1.3Update to 3.1.3
- Medium6.4Stored Cross-Site Scripting
mTouch Quiz
≤3.1.2Update to 3.1.3
- Medium6.5Cross-Site Request Forgery
mTouch Quiz
<3.1.3Update to 3.1.3
- Medium6.1Reflected Cross-Site Scripting
mTouch Quiz
≤3.1.2Update to 3.1.3
- High8.8SQL Injection
Welcart e-Commerce
<1.5.3Update to 1.5.3
- Medium4.3Missing Authorization Checks
Admin Management Xtended
≤2.4.0Update to 2.4.0.1
- Critical9.8SQL Injection
Smart External Link Click Monitor [Link Log]
<2.1Update to 2.1
- Medium6.1Cross-Site Scripting
YAWPP (Yet Another WordPress Petition Plugin)
≤1.2.2No patch available
- Medium6.4Cross-Site Scripting
Content text slider on post
<6.9Update to 6.9
- High8.8Cross-Site Request Forgery
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.63Update to 1.5.63
- Medium6.1Reflected Cross-Site Scripting
Role Scoper (Obsolete – Please install PublishPress Permissions)
<1.3.67Update to 1.3.67
- Medium6.1Cross-Site Scripting
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.63Update to 1.5.63
- High8.8Authenticated Command Injection
Cool Video Gallery
<2.0Update to 2.0
- Medium5.4Cross-Site Scripting via p_name parameter
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.63Update to 1.5.63