VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 25)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

Severity
Signals
Software

41,172 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 25)
SeverityVulnerabilityCVEInstallsPublished
High7.2Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
Independent Analytics Pro≤2.15.5Update to 2.16.0
CVE-2026-104744—
High7.5Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter
Forminator Forms – Contact Form, Payment Form & Custom Form Builder≤1.57.3.1Update to 1.58.0
CVE-2026-97638—
High7.5Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter
Email Templates Customizer and Designer for WordPress and WooCommerce≤1.5.14Update to 1.5.15
CVE-2026-107630—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parameter
CP Multi View Events Calendar≤1.4.43Update to 1.4.44
CVE-2026-119176—
High7.2Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter
easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution≤2.8.4Update to 2.8.5
CVE-2026-112365—
High7.2Unauthenticated Stored Cross-Site Scripting via Inbound Email Body
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce≤1.17.10Update to 1.17.11
CVE-2026-96894—
Medium4.3Cross-Site Request Forgery
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce≤4.7.5Update to 4.7.6
CVE-2026-119466—
Medium4.3Cross-Site Request Forgery
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini≤3.8.8Update to 3.8.9
CVE-2026-65566—
Medium6.5Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter
Ad Inserter – Ad Manager & AdSense Ads≤2.8.19Update to 2.8.20
CVE-2026-102905—
High8.1Unauthenticated Arbitrary File Upload via Avada Form Upload Field
Avada | Website Builder For WordPress & WooCommerce≤7.16.2Update to 7.16.4
CVE-2026-115346—
Medium6.5Unauthenticated Shortcode Injection via 'pagination_info' Parameter
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory≤2.8.198Update to 2.8.199
CVE-2026-118635—
Medium4.3Missing Authorization
Event Tickets and Registration≤5.30.2Update to 5.30.3
CVE-2026-62055—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Media Player Addons for Elementor – Audio and Video Widgets for Elementor≤1.1.10Update to 1.1.11
CVE-2026-119365—
Medium4.3Missing Authorization
The Events Calendar≤6.18.2Update to 6.18.3
CVE-2026-119367—
Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' Parameter
JS Help Desk – AI-Powered Support & Ticketing System≤5.0.1Update to 5.0.2
CVE-2026-104739—
High7.2Unauthenticated Stored Cross-Site Scripting
Iptanus File Upload≤5.2.1Update to 5.2.2
CVE-2026-66570—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name
Photo Engine (Media Organizer & Lightroom)≤6.5.7Update to 6.5.8
CVE-2026-120575—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title()
SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress≤0.9.9Update to 1.0.0
CVE-2026-120552—
Medium6.5Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint
Meow Gallery≤5.5.4Update to 5.5.5
CVE-2026-13747—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field
Themify Builder≤7.8.4Update to 7.8.5
CVE-2026-115869—
High8.1Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy≤3.7.2Update to 3.7.3
CVE-2026-120538—
Medium4.3Missing Authorization
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution≤3.2.6Update to 3.3.0
CVE-2026-62141—
High7.5Unauthenticated SQL Injection
Bookit — Booking & Appointment Calendar≤2.6.0.6Update to 2.6.0.7
CVE-2026-62048—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Events Calendar≤6.18.2Update to 6.18.3
CVE-2026-119369—
Medium4.3Missing Authorization
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar≤6.5.4Update to 6.5.5
CVE-2026-116407—
Medium5.3Missing Authorization
The Events Calendar≤6.18.2Update to 6.18.3
CVE-2026-119368—
High8.1Unauthenticated Account Takeover
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments≤4.9.5Update to 4.9.6
CVE-2026-120574—
Medium5.3Missing Authorization
JetFormBuilder — Dynamic Blocks Form Builder≤3.6.7.1Update to 3.6.8
CVE-2026-119482—
High7.4Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision
Essential Addons for Elementor – Popular Elementor Templates & Widgets≤6.8.7Update to 6.8.8
CVE-2026-118205—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure via PATCH /files/placements/<id> on orphaned placements
OpenStation – Admin Dashboard Notes, Custom Dashboard, AI Assistant & PWA≤1.1.16Update to 1.1.17
CVE-2026-109592—

Search VulnCrest Radar

Jump to

Are you sure?