CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 142)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.46Update to 3.7.46
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Ultimate Before After Image Slider & Gallery – BEAF
<4.7.19Update to 4.7.19
- High7.5Unauthenticated Denial of Service
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
≤9.8.0Update to 9.8.1
- Medium4.3Cross-Site Request Forgery
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
<2.7.2.1Update to 2.7.2.1
- High7.5Unauthenticated SQL Injection
Comments – wpDiscuz
<7.6.66Update to 7.6.66
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Ultimate Before After Image Slider & Gallery – BEAF
<4.7.19Update to 4.7.19
- Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.46Update to 3.7.46
- Medium5.3Unauthenticated Insecure Direct Object Reference
MotoPress Appointment Booking
<2.4.8Update to 2.4.8
- Medium5.3Unauthenticated Forged Payment Completion
Restaurant Menu and Food Ordering
<2.4.12Update to 2.4.12
- High7.2Unauthenticated Server-Side Request Forgery
LiteSpeed Cache
≤7.9Update to 7.9.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function
Easy Waveform Player
≤1.2.2Update to 1.2.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log
Broken Link Checker
≤2.4.13Update to 2.4.13.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter
Divi
≤4.27.5Update to 4.27.7
- Critical9.8Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field
SigmaForms Pro – AI Generated Forms
≤1.4.11Update to 1.4.12
- High8.8Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter
DevKit Pro
≤2.3.0Update to 2.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode
Divi
≤4.27.6Update to 4.27.7
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter
WP File Download
≤6.3.4Update to 6.3.5
- High8.1Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion
Gravity Forms
≤3.0.2Update to 3.0.3
- High7.5Authenticated (Subscriber+) PHP Object Injection
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.10Update to 4.3.11
- Critical9.89.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'
Booking for Appointments and Events Calendar – Amelia
8.0 – 9.6.2Update to 9.6.3
- High7.2Unauthenticated Stored Cross-Site Scripting
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
≤5.13.1Update to 5.14
- High8.8Authenticated (Subscriber+) Remote Code Execution
WatchMan-Site7
≤4.2.0No patch available
- Medium5.3Unauthenticated Information Exposure
Product Attachment for WooCommerce
≤2.3.4Update to 2.3.5
- Medium6.1Reflected Cross-Site Scripting
MapGeo – Interactive Geo Maps
≤1.6.30No patch available
- Medium6.4Authenticated (Customer+) Stored Cross-Site Scripting
AJAX Auth – Fast Logins, 2FA, Redirects
≤4.5.1Update to 4.6
- Medium4.3Authenticated (Contributor+) Arbitrary CSS Injection
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
≤2.5.0Update to 2.5.1
- Critical9.8Unauthenticated Privilege Escalation
Authorizer
≤3.15.1Update to 3.15.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
≤5.0.0.0Update to 5.0.0.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.
≤3.1.5Update to 3.1.6
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Booking Hub - AI-Powered Scheduling, Reservation and Appointment System for WordPress
≤1.3.1No patch available