CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 42)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤3.7.5Update to 3.8
- High8.1Unauthenticated PHP Object Injection
Paytium: Mollie payment forms & donations
≤5.0.5Update to 5.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting
VOD Infomaniak
≤1.5.14Update to 1.5.15
- Medium6.1Reflected Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.8Update to 7.4.9
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤4.9.7Update to 5.0.0
- Medium4.3Missing Authorization
SureDash – Community, Courses & Member Dashboard
≤1.12.2Update to 1.12.3
- High7.2Unauthenticated Stored Cross-Site Scripting
QA Assistants – Driven by data
≤5.3.0.1Update to 5.3.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting
W3 Total Cache
≤2.10.7Update to 2.11.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Off-Canvas Sidebars & Menus (Slidebars)
≤0.5.9Update to 0.5.9.1
- Medium5.3Missing Authorization
SureDash – Community, Courses & Member Dashboard
≤1.12.2Update to 1.12.3
- Medium5.3Missing Authorization
SureDash – Community, Courses & Member Dashboard
≤1.12.2Update to 1.12.3
- Medium5.3Unauthenticated Information Exposure
LiteSpeed Cache
≤7.9Update to 7.9.1
- High7.5Unauthenticated SQL Injection
Product Filter for WooCommerce by WBW
≤3.4.6Update to 3.4.7
- High8.1Unauthenticated PHP Object Injection
Newsletters
≤4.18.1Update to 4.18.2
- Medium6.1Reflected Cross-Site Scripting
We’re Open!
≤2.6Update to 2.7
- High7.5Unauthenticated SQL Injection
Newsletters
≤4.18.1Update to 4.18.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.26Update to 4.1.27
- Medium4.3Missing Authorization
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤3.1.0Update to 3.1.1
- Medium4.3Missing Authorization
Strong Testimonials
≤3.3.14Update to 3.3.15
- Medium5.3Missing Authorization
Falcon – Cache, Performance, Security, Cleanup, and Tweaks
≤2.12.0Update to 2.12.1
- Medium5.3Missing Authorization
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤4.3.2Update to 4.3.3
- Medium4.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
≤2.1.72Update to 2.1.80
- Medium4.3Cross-Site Request Forgery
Xpro Addons — 150+ Widgets for Elementor
≤1.7.10Update to 1.7.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Interactive Content – H5P
≤1.17.9Update to 1.17.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Addon Elements for Elementor (formerly Elementor Addon Elements)
≤1.14.4Update to 1.14.5
- Medium6.49.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress
8.5.49 – 9.0.2Update to 9.0.3
- Medium5.3Missing Authorization
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.193Update to 2.8.194
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Zoom API Credential Modification
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams
≤1.7.1Update to 1.7.2
- High7.2Authenticated (Administrator+) Remote Code Execution
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.193Update to 2.8.194
- Medium5.3Missing Authorization
Chikkili- Google Pay India for Woocommerce
≤1.0.6No patch available