CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 1342)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Request Forgery
DandyID Services
≤1.5.9No patch available
- Medium6.1Cross-Site Scripting
Mikiurl Wordpress Eklentisi
≤2.0No patch available
- High8.8Multiple Cross-Site Request Forgery
spnbabble
≤1.4.1No patch available
- Medium6.1Cross-Site Scripting
Our Team Showcase
<1.3Update to 1.3
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
WP-ViperGB
≤1.3.10Update to 1.3.11
- High8.8Cross-Site Request Forgery
Lightbox Photo Gallery
≤1.0No patch available
- High7.1Cross-Site Scripting
Easy Social Like Box – Popup – Sidebar Widget
<2.8.3Update to 2.8.3
- High7.2Cross-Site Scripting
Simple visitor stat
≤1.0No patch available
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
IP Ban
≤1.2.3Update to 1.2.4
- Medium6.1Cross-Site Request Forgery
Timed Popup WordPress Plugin
≤1.4No patch available
- Critical9.8Arbitrary File Upload
WP Symposium
≤14.11Update to 15.1
- Medium4.3Cross-Site Request Forgery
W3 Total Cache
≤0.9.4Update to 0.9.4.1
- Medium6.1Cross-Site Scripting
Simplelife
≤1.2No patch available
- Medium6.3Cross-Site Request Forgery
twitter-liveblog
≤1.1.2No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
twitterDash
≤2.1No patch available
- Medium6.1Cross-Site Request Forgery
yurl-retwitt
≤1.4No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Twimp WP
≤0.1No patch available
- Medium6.1Cross-Site Request Forgery
bird-feeder
≤1.2.3No patch available
- High8.8Cross-Site Request Forgery
TweetScribe
≤1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Wordfence Security – Firewall, Malware Scan, and Login Security
<5.1.5Update to 5.1.5
- Critical9.8Local File Inclusion
ChurcHope
≤2.1Update to 2.2
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Broken Link Checker
<1.10.2Update to 1.10.2
- Medium5.3CAPTCHA Bypass
Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms
<4.0.7Update to 4.0.7
- Medium6.5Unauthenticated Arbitrary File Read
google-mp3-audio-player
≤1.0.11Update to 1.0.12
- High8.8SQL Injection
Cart66 Lite :: WordPress Ecommerce
<1.5.2Update to 1.5.2
- Medium6.1Reflected Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<2.8.10Update to 2.8.10
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
CM Download Manager – Organize, Protect & Share Files in WordPress
≤2.0.6Update to 2.0.7
- High7.2JavaScript Injection
Rich Counter
<1.2.0Update to 1.2.0
- Medium5.3Full Path Disclosure
HTML5 MP3 Player with Playlist Free
≤2.7.0Update to 2.8.0
- Medium6.1Cross-Site Scripting
InstaSqueeze Sexy Squeeze Pages
all versionsNo patch available