VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 137)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 137)
SeverityVulnerabilityCVEInstallsPublished
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter
Divi≤4.27.6Update to 4.27.7
CVE-2026-3853—
Medium5.0Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter
Divi≤4.27.6Update to 4.27.7
CVE-2026-4361—
High7.2Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz≤2.12.2Update to 2.12.3
CVE-2026-18406—
High7.2Unauthenticated Stored Cross-Site Scripting via Post Body Field Value
Gravity Forms≤2.10.5Update to 3.0.0
CVE-2026-16649—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder
Anti-Spam, Spam FireWall by CleanTalk≤6.86Update to 6.87
CVE-2026-77830—
High8.8Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback
Welcart e-Commerce≤2.12.1Update to 2.12.2
CVE-2026-19887—
High7.2Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters
QuickCal≤1.0.20No patch available
CVE-2026-15984—
High7.2Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator
W3 Total Cache≤2.10.5Update to 2.10.6
CVE-2026-78438—
High7.2Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.15.1Update to 3.15.2
CVE-2026-19769—
Medium6.1Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter
Beaver Builder Plugin (Starter Version)≤2.11.0.1Update to 2.11.0.2
CVE-2026-18843—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more≤3.13.4Update to 3.13.5
CVE-2026-77263—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more≤3.13.4Update to 3.13.5
CVE-2026-77233—
Critical9.8Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery
MStore API – Create Native Android & iOS Apps On The Cloud≤4.20.0Update to 4.21.1
CVE-2026-13447—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute
DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer≤2.4.30Update to 2.4.37
CVE-2026-8623—
Medium4.3Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage
Theme My Login≤7.1.15Update to 7.2.0
CVE-2026-83628—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box
Social Chat – Click To Chat App Button≤8.6.2Update to 8.6.3
CVE-2026-18404—
Critical9.8Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN≤3.21.0Update to 3.21.1
CVE-2026-83627—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML
DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer≤2.4.30Update to 2.4.37
CVE-2026-8625—
Medium4.9Authenticated (Administrator+) SQL Injection
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode<4.4.2Update to 4.4.2
CVE-2026-82186—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Woodmart<8.3.8Update to 8.3.8
CVE-2026-27086—
Medium5.3Missing Authorization
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell<3.13.0Update to 3.13.0
CVE-2025-15691—
High7.2Authenticated (Administrator+) Remote Code Execution
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN<3.21.2Update to 3.21.2
CVE-2026-19224—
Medium4.9Authenticated (Shop Manager+) SQL Injection
WooCommerce≤10.9.4Update to 11.0
CVE-2026-57777—
Medium5.45.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint
LearnDash LMS4.25.0 – 5.1.6Update to 5.1.6.1
CVE-2026-12843—
Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Directorist: AI-Powered Business Directory, Listings & Classified Ads<8.9Update to 8.9
CVE-2026-84066—
Critical9.8Unauthenticated PHP Object Injection in Arbitrary Form Fields
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance≤1.31.0Update to 1.31.1
CVE-2026-10196—
Medium5.3Missing Authorization
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace≤2.11.11Update to 2.12.0
CVE-2026-32480—
Medium6.4Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters
Ninja Forms - Scheduled Exports≤3.0.3Update to 3.0.4
CVE-2026-87870—
Medium5.3Unauthenticated Information Exposure
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell<3.13.0Update to 3.13.0
CVE-2026-79631—
Medium5.3Missing Authorization
Content Views – Post Grid & Filter (Shortcode, Blocks, Elementor Widgets)<4.5.1.2Update to 4.5.1.2
CVE-2026-17517—

Search VulnCrest Radar

Jump to

Are you sure?