CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 133)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action
WP EasyCart: Shopping Cart and eCommerce Store
≤5.9.3Update to 5.9.4
- Medium6.1Reflected Cross-Site Scripting via 'wpf_fid' Parameter
Product Filter for WooCommerce by WBW
≤3.4.2Update to 3.4.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter
Podlove Podcast Publisher
≤4.5.5Update to 4.5.6
- Medium4.9Authenticated (Custom+) SQL Injection via 'status' Parameter
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
≤1.31.0Update to 1.31.1
- Medium6.6Authenticated (Administrator+) PHP Object Injection via Form Import
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.14.6Update to 3.14.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute
My Calendar – Accessible Event Manager
≤3.8.3Update to 3.8.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes
My Calendar – Accessible Event Manager
≤3.8.3Update to 3.8.4
- High8.8Authenticated (Author+) Remote Code Execution to Privilege Escalation
FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment
≤3.1.10Update to 3.1.11
- High7.5Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.22Update to 4.1.23
- High7.5Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.22Update to 4.1.23
- High7.2Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress
≤1.7.5Update to 1.7.6
- Medium5.3Captcha Bypass
Simple CAPTCHA with Cloudflare Turnstile
≤1.42.1Update to 1.42.3
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.22Update to 4.1.23
- High7.2Unauthenticated Stored Cross-Site Scripting
WPAdverts – Classifieds Plugin
≤2.3.3Update to 2.3.4
- High7.2Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values
Repeater Fields for Gravity Forms
≤3.0.4Update to 3.1.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Settings Update
WP-Stateless – Google Cloud Storage
≤4.4.1Update to 4.4.2
- Medium5.3Missing Authorization
Return Refund and Exchange For WooCommerce
≤4.6.4Update to 4.6.5
- Medium5.3Missing Authorization
WP Travel – Ultimate Travel Booking System, Tour Management Engine
≤12.0.3Update to 12.0.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Page Visits Counter – Lite
≤1.2.3Update to 2.0.0
- Medium5.3Unauthenticated Unauthorized Lead and Search Manipulation
IMPress for IDX Broker
≤3.3.0Update to 3.3.1
- Medium5.3Missing Authorization
Thanko Thank You Page Customizer for WooCommerce
≤1.2.2Update to 1.2.3
- High8.1Unauthenticated PHP Object Injection
Wise Chat
≤3.4.2Update to 3.4.3
- Medium4.3Missing Authorization
MailMunch – Grow your Email List
≤3.3.0Update to 3.3.1
- Medium5.36.3.0 - Unauthenticated Second Factor Authentication Bypass
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
≤19.2Update to 19.3 or 6.3.1
- Medium6.1Unauthenticated Arbitrary Shortcode Execution
Simple CAPTCHA with Cloudflare Turnstile
≤1.42.1Update to 1.42.3
- Medium5.3Unauthenticated Inflated Gift Card Credit Acquisition
Ultimate Gift Cards for WooCommerce
<3.2.10Update to 3.2.10
- High7.26.2.5 - Unauthenticated Stored Cross-Site Scripting
Kirki – Freeform Page Builder, Website Builder & Customizer
6.2.1 – 6.2.5Update to 6.3.0
- Medium5.3Missing Authorization
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.5No patch available
- Medium4.3Missing Authorization
IMPress for IDX Broker
≤3.3.0Update to 3.3.1
- Medium5.3Unauthorized WordPress Account Creation
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
<4.7.0Update to 4.7.0