VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 136)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 136)
SeverityVulnerabilityCVEInstallsPublished
High7.5Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator
HivePress Authentication≤1.1.4Update to 1.1.5
CVE-2026-18056—
Critical9.8Unauthenticated Account Takeover via '_acf_objects' Object Identifier
ACF Frontend Admin by DynamiApps≤3.29.12Update to 3.29.13
CVE-2026-75816—
Critical9.8Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter
MemberDash≤1.8.5Update to 1.8.6
CVE-2026-16310—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder<5.9.8Update to 5.9.8
CVE-2026-84021—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Greenshift – animation and page builder blocks<13.2.0Update to 13.2.0
CVE-2026-83544—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
VikWidgetsLoader – Collection of Widgets<1.12.0Update to 1.12.0
CVE-2026-84899—
Medium4.3Authenticated (Contributor+) Information Exposure
The Events Calendar<6.17.3.1Update to 6.17.3.1
CVE-2026-84745—
Medium4.96.2.5 - Authenticated (Editor+) SQL Injection
Kirki – Freeform Page Builder, Website Builder & Customizer6.0.0 – 6.2.5Update to 6.3.0
CVE-2026-84221—
Medium4.36.2.5 - Authenticated (Custom Role+) Insecure Direct Object Reference
Kirki – Freeform Page Builder, Website Builder & Customizer6.0.0 – 6.2.5Update to 6.3.0
CVE-2026-84225—
Medium4.3Missing Authorization
Search Atlas SEO – OTTO AI SEO Automation for WordPress<2.6.24Update to 2.6.24
CVE-2026-15247—
Medium5.3Unauthenticated Information Exposure
My Private Site – Make Your Whole Site Private, Force Login & Block Registration Spam<4.2.3Update to 4.2.3
CVE-2026-81348—
Medium6.5Authenticated (Contributor+) Path Traversal
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce<4.1.21Update to 4.1.21
CVE-2026-84898—
Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
Greenshift – animation and page builder blocks<13.2.0Update to 13.2.0
CVE-2026-83543—
Medium4.95.0.0 - Authenticated (Administrator+) Path Traversal
JCH Optimize4.2.1 – 5.0.0Update to 5.0.1
CVE-2025-15693—
Medium6.42.3.3 - Authenticated (Custom Role+) Stored Cross-Site Scripting
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates1.18.0 – 2.3.3Update to 3.4.0
CVE-2026-82846—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
CatFolders Document Gallery & PDF Library<2.0.7Update to 2.0.7
CVE-2026-84930—
Medium4.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce<4.1.22Update to 4.1.22
CVE-2026-84901—
Medium4.34.0.7 - Authenticated (Contributor+) Insecure Direct Object Reference
Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News4.0.0 – 4.0.7Update to 4.0.8
CVE-2026-78150—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder<51.1.77Update to 51.1.77
CVE-2026-84896—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder<5.9.8Update to 5.9.8
CVE-2026-84022—
Medium6.5Authenticated (Contributor+) SQL Injection
Video Player for YouTube – Embed Videos Your Visitors Will Love to Watch<2.1.0Update to 2.1.0
CVE-2026-84937—
Medium5.3Unauthenticated Insecure Direct Object Reference
Accept Stripe Payments<2.1.4Update to 2.1.4
CVE-2026-81424—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Joli Table Of Contents – Table of Contents with Gutenberg Block & Shortcode<3.0.3Update to 3.0.3
CVE-2026-84931—
Medium4.34.6.3 - Missing Authorization
EmbedPress4.6.0 – 4.6.3Update to 4.6.4
CVE-2026-84926—
Critical9.82.3.22 - Unauthenticated Hook Injection
Post Grid2.2.85 – 2.3.22Update to 2.3.23
CVE-2024-11080—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute
Pods – Custom Content Types and Fields≤3.3.9.1Update to 3.3.9.2
CVE-2026-76573—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute
FooGallery Photo Gallery : Image, Video & Masonry Galleries≤3.3.2Update to 3.3.3
CVE-2026-85414—
High7.2Unauthenticated Stored Cross-Site Scripting via IP Address Header
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics≤1.10.2Update to 1.10.3
CVE-2026-83625—
Medium6.1Reflected Cross-Site Scripting via 'formData[id]' Parameter
Unlimited Elements for Elementor≤2.0.17Update to 2.0.18
CVE-2026-75586—
Medium6.5Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter
WP File Download≤6.3.8Update to 6.3.9
CVE-2026-14975—

Search VulnCrest Radar

Jump to

Are you sure?