CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 1349)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Quick Page/Post Redirect Plugin
<5.0.5Update to 5.0.5
- Medium6.1Cross-Site Scripting
wp-media-player
≤0.8No patch available
- Medium5.3Reflected Cross-Site Scripting
Verification Code for Comments
≤2.1.0No patch available
- Medium6.1DOM Cross-Site Scripting
Image Slider
<1.1.7Update to 1.1.7
- Medium6.1Cross-Site Scripting
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤0.4.4Update to 0.4.5
- Critical9.8SQL Injection
Yoast Duplicate Post
≤2.5Update to 2.6
- Medium6.1Unauthenticated Multiple Cross-Site Scripting
Media Library Categories
≤1.1.1No patch available
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.3.9Update to 5.3.9
- Medium6.1Cross-Site Scripting
WP Symposium
≤11.11.26Update to 11.12.08
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Dropdown Menu Widget
≤1.9.7No patch available
- Medium4.3Cross-Site Request Forgery
WordPress Related Posts
<2.7.2Update to 2.7.2
- High7.3Unspecified Vulnerability
Image News Slider
≤3.2Update to 3.3
- Critical9.8Unrestricted File Upload
gravity-file-ajax-upload-free
≤1.1No patch available
- Medium6.1Cross-Site Scripting
XEN Carousel
≤0.12.2No patch available
- Critical9.8Remote File Inclusion
WP-Table
≤1.43Update to 1.44
- High8.8Cross-Site Request Forgery
WP Activity Log
<1.2.5Update to 1.2.5
- Medium6.1Multiple Cross-Site Scripting
WP Super Cache
≤1.3Update to 1.3.1
- Medium6.1Cross-Site Scripting
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
≤2.71Update to 2.72
- Medium6.3Cross-Site Request Forgery
Cart66 Lite :: WordPress Ecommerce
<1.5.1.15Update to 1.5.1.15
- Medium6.1Multiple Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction
≤1.30Update to 1.31
- Medium4.7Cross-Site Request Forgery
Simple Shopping Cart
<3.6Update to 3.6
- High7.1Cross-Site Scripting
WP Symposium
<13.04Update to 13.04
- High8.8SQL Injection
Mingle Forum
≤1.0.32.1Update to 1.0.33
- Medium6.1Reflected Cross-Site Scripting
Platinum SEO
≤1.3.7Update to 1.3.8
- High7.2Cross-Site Scripting
Wordfence Security – Firewall, Malware Scan, and Login Security
≤5.1.3Update to 5.1.4
- High8.8Cross-Site Request Forgery
WhyDoWork AdSense
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
WhyDoWork AdSense
≤1.2No patch available
- Critical9.8SQL Injection
fbgorilla
all versionsNo patch available
- Critical9.8SQL Injection
Lead-Octopus-Power
<1.1.1Update to 1.1.1
- Medium5.3Information Disclosure
WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps
<2.0.2Update to 2.0.2