CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 141)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
<2.7.2.1Update to 2.7.2.1
- Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.46Update to 3.7.46
- Medium5.3Unauthenticated Two-Factor Authentication Bypass
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
≤9.8.0Update to 9.8.1
- High7.2Unauthenticated Stored Cross-Site Scripting
TrustedSite
≤1.2.5Update to 1.2.6
- High7.2Unauthenticated Stored Cross-Site Scripting
WP QuickLaTeX
≤3.8.8No patch available
- Medium4.3Missing Authorization
Classified Listing – AI-Powered Classified ads & Business Directory
≤6.1.3Update to 6.1.5
- High7.5Authenticated (Contributor+) PHP Object Injection
RTMKit for Elementor – Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready
≤2.1.5Update to 2.1.6
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Bricksforge
≤3.1.8.8Update to 3.1.8.9
- High8.2Unauthenticated Path Traversal
ACF Frontend Admin by DynamiApps
≤3.29.12Update to 3.29.13
- Medium5.3Unauthenticated Payment Bypass
WP Easy Pay – Payment and Donation Form Builder for Square
≤4.5.3Update to 4.5.4
- Medium4.3Cross-Site Request Forgery
Grand Tour | Travel Agency WordPress
≤5.5.1No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Graphene
≤2.9.4Update to 2.9.6
- Medium4.3Missing Authorization
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.277Update to 1.0.277
- High7.2File Uploads <= 3.3.26 - Unauthenticated Stored Cross-Site Scripting
Ninja Forms - File Uploads
≤3.3.26No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Calculation for contact form 7
≤1.0Update to 1.1
- Medium4.9Authenticated (Administrator+) SQL Injection
WPvivid — Backup, Migration & Staging
<0.9.133Update to 0.9.133
- Medium5.3Unauthenticated Information Exposure
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.277Update to 1.0.277
- Medium5.3Unauthenticated Product Price Manipulation
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
<3.13.0Update to 3.13.0
- Medium5.3Missing Authorization to Unauthenticated Settings Update
WP Compress – Instant Performance & Speed Optimization
≤7.21.28Update to 7.22.0
- High7.5Unauthenticated Denial of Service
Migrate Guru – Site Migration & Cloning
≤6.65Update to 6.72
- High7.5Unauthenticated SQL Injection
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.174Update to 2.8.175
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Choosly – Product Variations Swatches for WooCommerce
≤1.1.18Update to 1.1.19
- Medium5.3Unauthenticated Unauthorized Order Status Manipulation
ePayco plugin for WooCommerce
<8.4.7Update to 8.4.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Under Construction
≤5.82Update to 5.83
- Medium4.3Cross-Site Request Forgery
Mang Board
≤2.3.8Update to 2.3.9
- Medium4.3Authenticated (Author+) Information Exposure
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.277Update to 1.0.277
- High7.5Unauthenticated Denial of Service
MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall
≤6.69Update to 6.72
- High7.2Unauthenticated Stored Cross-Site Scripting
Breadcrumb NavXT
≤7.5.1Update to 7.5.2
- Medium5.3Missing Authorization
YITH Request a Quote for WooCommerce (Premium)
<4.46.0Update to 4.46.0
- High7.2Unauthenticated Stored Cross-Site Scripting
RTMKit for Elementor – Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready
≤2.1.5Update to 2.1.6