VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 28)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

Severity
Signals
Software

41,172 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 28)
SeverityVulnerabilityCVEInstallsPublished
High7.5Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini≤3.8.6Update to 3.8.7
CVE-2026-110732—
Medium6.5Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authentication
Page and Post Restriction≤1.6.1Update to 1.6.2
CVE-2026-118194—
Medium4.3Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameter
Content Egg – Affiliate Product Importer & Price Comparison≤12.0.0Update to 12.1.0
CVE-2026-119087—
Medium6.4Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter
Cool FormKit Lite – Advanced Form Builder for Elementor≤2.7.9Update to 2.7.10
CVE-2026-118500—
Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX Action
Content Egg – Affiliate Product Importer & Price Comparison≤12.0.0Update to 12.1.0
CVE-2026-119059—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute
Events Made Easy≤3.3.1Update to 3.3.2
CVE-2026-118634—
Medium6.5Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute
JoomSport – for Sports: Team & League, Football, Hockey & more≤5.7.14Update to 5.7.15
CVE-2026-118698—
Medium6.5Unauthenticated Limited File Deletion via Draft Upload Metadata
Forminator Forms – Contact Form, Payment Form & Custom Form Builder≤1.55.0.2Update to 1.55.1
CVE-2026-5461—
High8.8Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field
Export and Import Users and Customers≤2.7.5Update to 2.7.6
CVE-2026-104368—
Medium5.3Unauthenticated Information Exposure
Document Library Lite≤1.3.0Update to 1.3.1
CVE-2026-48200—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates≤6.5.3Update to 6.6.0
CVE-2026-116848—
Medium4.3Missing Authorization
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates≤3.50.1Update to 3.51.0
CVE-2026-109891—
Medium4.3Missing Authorization
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce≤1.17.10Update to 1.17.11
CVE-2026-25448—
Medium5.3Missing Authorization
Page and Post Restriction≤1.6.1Update to 1.6.2
CVE-2026-54852—
Medium4.3Missing Authorization
EventPrime – Events Calendar, Bookings, Tickets & AI≤4.3.6.0Update to 4.3.6.1
CVE-2026-42691—
Medium5.3Missing Authorization
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred≤4.0.2Update to 4.0.3
CVE-2026-97073—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
HTML5 Video Player – embed fast, responsive videos with ease≤2.14.0Update to 2.14.1
CVE-2026-118097—
Medium4.3Cross-Site Request Forgery
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell≤3.13.5Update to 3.13.6
CVE-2026-27062—
Medium5.3Missing Authorization
Custom Price for WooCommerce≤1.1.29Update to 1.1.30
CVE-2026-115601—
Medium5.3Missing Authorization
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor≤4.0.5Update to 4.0.6
CVE-2026-54853—
Medium5.3Missing Authorization
Kit (formerly ConvertKit) – Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership≤3.4.7Update to 3.4.8
CVE-2026-27063—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Strong Testimonials≤3.3.15Update to 3.3.16
CVE-2026-114706—
Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder≤5.3.0Update to 5.3.1
CVE-2026-25450—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates≤3.50.1Update to 3.51.0
CVE-2026-116850—
Medium5.3Missing Authorization
E-cab Taxi Booking Manager for Woocommerce≤2.1.6Update to 2.1.7
CVE-2026-114181—
Medium5.3Missing Authorization
ShopBuilder – WooCommerce Builder For Elementor≤3.4.2Update to 3.4.3
CVE-2026-54871—
Medium5.3Missing Authorization
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell≤3.13.5Update to 3.13.6
CVE-2026-118088—
Medium4.3Missing Authorization
SureDash – Community, Courses & Member Dashboard≤1.12.3Update to 1.12.4
CVE-2026-115605—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
StreamCast – bring live radio to your site with a sleek player≤2.4.6Update to 2.4.7
CVE-2026-116849—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
SureDash – Community, Courses & Member Dashboard≤1.12.3Update to 1.12.4
CVE-2026-110881—

Search VulnCrest Radar

Jump to

Are you sure?