CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 1338)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Arbitrary File Upload/Deletion
Easy Digital Downloads – Upload File
≤1.0.3Update to 1.0.4
- Medium6.4Cross-Site Scripting via example.html
WordPress
≤4.2.1Update to 3.7.8 or 3.8.8 or 3.9.6 or 4.0.5 or 4.1.5 or 4.2.2
- High8.8TheCartPress eCommerce Shopping Cart <= 1.5.3.6 Cross-Site Request Forgery
TheCartPress eCommerce Shopping Cart
≤1.5.3.6No patch available
- Medium5.4Authenticated (Subscriber+) Cross-Site Scripting
Professional Social Sharing Buttons, Icons & Related Posts – Shareaholic
<7.6.1.0Update to 7.6.1.0
- High7.5Arbitrary File Download
Aspose Importer & Exporter (Discontinued)
≤2.0Update to 3.0
- Critical9.8SQL Injection
All-In-One Security (AIOS) – Security and Firewall
<3.9.1Update to 3.9.1
- Critical10.0Multiple SQL Injections
Simple Ads Manager
<2.7.97Update to 2.7.97
- Medium5.3Information Disclosure
Simple Ads Manager
≤2.5.96Update to 2.5.97
- Critical9.8SQL Injection
WP Business Intelligence Lite
≤1.6.2Update to 1.6.3
- Critical9.8Arbitrary File Upload
Simple Ads Manager
≤2.5.94Update to 2.5.96
- High7.1Reflected Cross-Site Scripting
Favicon by RealFaviconGenerator
<1.2.13Update to 1.2.13
- Medium5.3Information Disclosure
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
<2.2.6Update to 2.2.6
- High7.5Arbitrary File Download
Aspose.PDF Exporter
<2.0Update to 2.0
- Critical9.8Arbitrary File Upload
VideoWhisper Video Presentation
≤4.1.4Update to 4.6.1
- Critical9.8Unrestricted File Upload leading to Remote Code Execuction
Webcam Video Conference
≤4.91.8Update to 4.91.9
- High7.5Unauthenticated Arbitrary File Read
Aspose.Words – Import and Export word documents
≤1.0Update to 2.0
- High7.1Cross-Site Scripting
flashy
≤1.3No patch available
- High8.8Arbitrary File Upload
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
<2.0.77.3Update to 2.0.77.3
- High8.8Cross-Site Request Forgery
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
<2.0.77.3Update to 2.0.77.3
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
AB Google Map Travel (AB-MAP)
<4.0Update to 4.0
- High8.8Arbitrary File Download
WP Marketplace – Complete Shopping Cart / eCommerce Solution
<2.4.1Update to 2.4.1
- Medium6.5Path Traversal
WP Marketplace – Complete Shopping Cart / eCommerce Solution
<2.4.1Update to 2.4.1
- Critical9.1SQL Injection
Gravity Forms
≤1.9.3.5Update to 1.9.3.6
- Critical9.8Arbitrary File Upload
ReFlex Gallery » WordPress Photo Gallery
<3.1.4Update to 3.1.4
- Critical9.8Arbitrary File Upload
Work The Flow File Upload
≤2.5.2Update to 2.5.3
- Medium5.4Authenticated Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.2.13Update to 1.2.13
- High7.2Stored Cross-Site Scripting
WooCommerce
<2.3.6Update to 2.3.6
- High7.2Authenticated (Admin+) SQL Injection
Responsive Slider – Image Slider – Slideshow for WordPress
<2.7.0Update to 2.7.0
- Critical9.8SQL Injection
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
<3.2.5Update to 3.2.5
- Critical9.8SQL Injection
Contact Form, Drag and Drop Form Builder Plugin – Live Forms
<3.2.0Update to 3.2.0