CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 140)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
≤2.7.7Update to 2.7.8
- High7.5Unauthenticated SQL Injection
VikAppointments Services Booking Calendar
≤1.2.20Update to 1.2.21
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter
Divi
≤4.27.6Update to 4.27.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
≤2.4.4Update to 2.4.5
- Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
<2.7.2.1Update to 2.7.2.1
- Medium6.5Authenticated (Administrator+) Arbitrary File Deletion
WPvivid — Backup, Migration & Staging
<0.9.134Update to 0.9.134
- Medium5.3Unauthenticated Insecure Direct Object Reference
PublishPress Permissions: Access Control, Content Permissions, User Access
≤4.8.3Update to 4.8.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Gallery PhotoBlocks
≤1.3.4Update to 1.3.5
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.11.11Update to 2.12.0
- Medium6.4Authenticated (Contributor +) Stored Cross-Site Scripting
SEO WRITING – AI Writer for SEO & AI Search
≤1.12.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤2.15.27Update to 2.15.28
- High7.2Unauthenticated Stored Cross-Site Scripting
EWWW Image Optimizer
≤8.7.6Update to 8.7.7
- Medium5.3Missing Authorization
RentSyst – CRM solution for fleet management
≤2.1.3No patch available
- Low3.13.15.1 - Authenticated (Custom Role+) Information Exposure
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
3.14.0 – 3.15.1Update to 3.15.2
- High7.5Unauthenticated Denial of Service
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
≤10.1.08Update to 10.1.09
- Medium5.3Unauthenticated Price Manipulation
E-cab Taxi Booking Manager for Woocommerce
<2.0.5Update to 2.0.5
- Medium4.3Cross-Site Request Forgery
Simply Schedule Appointments
≤1.6.12.23Update to 1.6.12.24
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.46Update to 3.7.46
- Medium4.3Cross-Site Request Forgery
Activity Log – Monitor User and Agent Changes
≤2.13.1Update to 2.14.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Estatik Real Estate Plugin
≤4.3.4No patch available
- High7.2Authenticated (Administrator+) Arbitrary File Upload
WPvivid — Backup, Migration & Staging
<0.9.134Update to 0.9.134
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤14.16.11Update to 14.16.12
- Medium5.3Unauthenticated Information Exposure
FormLayer
<1.0.9Update to 1.0.9
- Medium5.3Unauthenticated Information Exposure
Xpro Addons — 150+ Widgets for Elementor
<1.7.8Update to 1.7.8
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Classified Listing – AI-Powered Classified ads & Business Directory
≤6.1.0Update to 6.1.1
- Medium5.3Unauthenticated Information Exposure
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.46Update to 3.7.46
- Medium5.3Missing Authorization
Ultimate Gift Cards for WooCommerce
≤3.2.9Update to 3.2.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Social Media Share Buttons & Social Sharing Icons
<3.0.1Update to 3.0.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Simple Payment
≤2.5.1Update to 2.5.2
- Medium5.5Authenticated (Editor+) Server-Side Request Forgery
Broken Link Checker
≤2.4.14Update to 2.4.14.1