VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 22)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

Severity
Signals
Software

41,172 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 22)
SeverityVulnerabilityCVEInstallsPublished
Medium4.32.3.25 - Missing Authorization
Product Gallery Slider, Additional Variation Images for WooCommerce2.3.23 – <2.3.26Update to 2.3.26
CVE-2026-120318—
High7.3Unauthenticated Privilege Escalation
JetFormBuilder — Dynamic Blocks Form Builder≤3.6.7.1Update to 3.6.8
CVE-2026-119481—
High7.2Unauthenticated Stored Cross-Site Scripting
Noptin – Newsletter, New Post Notifications & Email Automation≤4.4.2Update to 4.4.3
CVE-2026-119468—
High7.2Unauthenticated Stored Cross-Site Scripting
Comments – wpDiscuz≤7.6.73Update to 7.6.74
CVE-2026-119366—
Medium6.1Reflected Cross-Site Scripting
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More<5.1.0Update to 5.1.0
CVE-2026-1122431M+
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Kali Forms — Contact Form & Drag-and-Drop Builder≤2.4.28Update to 2.4.29
CVE-2026-106649—
Medium5.34.7.5 - Unauthenticated Payment Confirmation Bypass
Eupago Gateway For Woocommerce4.5.0 – 4.7.5No patch available
CVE-2026-91075—
Medium5.3Missing Authorization to Unauthenticated Settings Update
DT Directory Lite Addon≤1.1No patch available
CVE-2026-105993—
Medium5.33.0.1 - Unauthenticated Arbitrary Order Status Manipulation
CryptoCloud – Crypto Payment Gateway3.0.0 – 3.0.1No patch available
CVE-2026-103327—
Medium6.5Unauthenticated SQL Injection via 'w2dc_level_filter' Parameter
Web 2.0 Directory plugin for WordPress≤2.10.12Update to 3.0.0
CVE-2026-15272—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via REST update endpoint
FlexStock – Product Stock Sync with Google Sheets for WooCommerce≤3.17.2Update to 3.17.3
CVE-2026-107711—
Medium6.1Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.15.5Update to 3.15.6
CVE-2026-100151—
High8.8Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery≤4.4.1Update to 4.5.0
CVE-2026-76010—
Medium4.3Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Change
Germanized for WooCommerce≤4.1.4Update to 4.1.5
CVE-2026-109231—
Medium6.1Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' Parameter
WooCommerce Extra Product Options Pro≤3.3.2Update to 3.3.3
CVE-2026-104926—
High7.2Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint
Debug Log Manager – Conveniently Monitor and Inspect Errors≤2.5.2Update to 2.5.3
CVE-2026-120114—
High7.5Unauthenticated SQL Injection via 'idfield' Parameter
WP Directory Kit≤1.6.0Update to 1.6.1
CVE-2026-109197—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory≤2.8.197Update to 2.8.198
CVE-2026-116752—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Name
BuddyBoss Platform≤3.6.0Update to 3.7.0
CVE-2026-96554—
Medium5.3Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)≤5.0.3Update to 5.0.4
CVE-2026-109367—
Medium5.3Unauthenticated Sensitive Information Exposure in 'page' Parameter
Booking for Appointments and Events Calendar – Amelia≤2.4.12Update to 2.4.13
CVE-2026-103915—
Critical9.8Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data
SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications≤3.10.2Update to 3.11.0
CVE-2026-118235—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter block
Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News≤4.0.9Update to 4.0.10
CVE-2026-119160—
Medium5.3Authenticated (Subscriber+) SQL Injection via 'id' Parameter
Newsletters≤4.18.1Update to 4.18.2
CVE-2026-101325—
High7.2Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content
FeedWordPress≤2026.0517Update to 2026.1016
CVE-2026-110530—
Critical9.1Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter
Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress≤1.1.9Update to 1.2.0
CVE-2026-103882—
High7.2Unauthenticated Stored Cross-Site Scripting
WP Activity Log≤5.6.1Update to 5.6.2
CVE-2026-120075—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author term name
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors≤4.17.0Update to 4.18.0
CVE-2026-111592—
Medium6.1Reflected Cross-Site Scripting via 'field_attr[required]' Parameter
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission≤4.3.13Update to 4.3.14
CVE-2026-103962—
High8.8Authenticated (Subscriber+) Privilege Escalation via post_content Parameter
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission≤4.3.13Update to 4.3.14
CVE-2026-120070—

Search VulnCrest Radar

Jump to

Are you sure?