CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 1337)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.3 | Reflected Cross Site Scripting | CVE-2015-10098 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9370 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9533 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9376 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9365 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9367 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9374 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9296 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9511 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9528 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9522 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9371 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9366 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9372 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9378 | — | |
| Medium6.1 | Cross-Sell and Upsell <= 1.1.2 - Reflected Cross-Site Scripting | CVE-2015-9510 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9525 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9506 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9514 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9355 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9526 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9531 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9535 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-10110 | — | |
| High7.5 | Missing Access Controls | CVE-2015-9337 | — | |
| Medium5.3 | Cross-Site Scripting | CVE-2014-4518 | — | |
| Medium5.3 | SQL Injection | CVE-2015-3325 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9493 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-10137 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9333 | — |
- Medium5.3Reflected Cross Site Scripting
Broken Link Checker
<1.10.6Update to 1.10.6
- Medium6.1Reflected Cross-Site Scripting
Exchange Addon Invoices
<1.4.0Update to 1.4.0
- Medium6.1Cross-Site Scripting
Lattice
<1.1.5Update to 1.1.5
- Medium6.1Reflected Cross-Site Scripting
Mobile
<1.2.8Update to 1.2.8
- Medium6.1Reflected Cross-Site Scripting
Authorize.net Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
- Medium6.1Reflected Cross-Site Scripting
Easy Canadian Sales Taxes Add-On for iThemes Exchange
<1.1.0Update to 1.1.0
- Medium6.1Reflected Cross-Site Scripting
Stripe Add-on for iThemes Exchange
<1.2.0Update to 1.2.0
- Medium6.1Reflected Cross-Site Scripting
Download Monitor
<1.7.1Update to 1.7.1
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Conditional Success Redirects
<1.1.1Update to 1.1.1
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Software Licensing
<3.2.3Update to 3.2.3
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads - QR Codes
≤1.1.0Update to 1.1.1
- Medium6.1Reflected Cross-Site Scripting
Manual Purchases Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
- Medium6.1Reflected Cross-Site Scripting
Exchange Addon Custom URL Tracking
<1.1.0Update to 1.1.0
- Medium6.1Reflected Cross-Site Scripting
Exchange Addon Membership
<1.3.0Update to 1.3.0
- Medium6.1Reflected Cross-Site Scripting
Market
<5.1.27Update to 5.1.27
- Medium6.1Cross-Sell and Upsell <= 1.1.2 - Reflected Cross-Site Scripting
Easy Digital Downloads - Cross-Sell and Upsell
≤1.1.2Update to 1.1.3
- Medium6.1Cross-Site Scripting
Easy Digital Downloads - Recurring Payments
≤2.3Update to 2.3.1
- Medium6.1Cross-Site Scripting
Easy Digital Downloads - Amazon S3
≤2.1.3Update to 2.1.4
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads - Free Downloads
≤2.3.6Update to 2.3.7
- Medium6.1Cross-Site Scripting
Two Factor Authentication
<1.1.10Update to 1.1.10
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads - Product Reviews
≤1.3.8Update to 1.3.10
- Medium6.1Cross-Site Scripting
Easy Digital Downloads - Wish Lists
≤1.1Update to 1.1.1
- Medium6.1Cross-Site Scripting
Shoppette
<1.0.5Update to 1.0.5
- Medium6.1Reflected Cross-Site Scripting
TinyChat Room Spy
≤1.2.8Update to 1.2.9
- High7.5Missing Access Controls
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤2.1.3Update to 2.1.4
- Medium5.3Cross-Site Scripting
Contact Form by ContactMe.com
≤2.3No patch available
- Medium5.3SQL Injection
WP Symposium
<15.4Update to 15.4
- Medium6.1Cross-Site Scripting
My Wish List
<1.4.2Update to 1.4.2
- Critical9.8Arbitrary File Upload
Website Contact Form With File Upload
≤1.3.4Update to 1.4
- Critical9.8SQL Injection
cformsII
<14.6.10Update to 14.6.10