CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 5)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
- Medium4.3Cross-Site Request Forgery
WPIDE – File Manager & Code Editor
≤3.6.4Update to 3.6.5
- High7.5Authenticated (Contributor+) Local File Inclusion
All in One Addons For WPBakery Page Builder (formerly Visual Composer)
≤1.2No patch available
- Medium5.3Missing Authorization
Cargo Shipping Location for WooCommerce
<6.0Update to 6.0
- Medium5.3Unauthenticated Information Exposure
BulletProof Security
≤7.2No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Zion Builder – Website Builder for Speed & Creativity
≤3.6.17No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook
Avada (Fusion) Builder
≤3.16.1Update to 3.16.2
- High7.2Unauthenticated Stored Cross-Site Scripting via Registration Custom Field
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤7.8.1Update to 7.8.2
- High8.1Unauthenticated Authentication Bypass in Language-per-Domain SSO via 'wpml_sso_token_domain' Parameter
WPML Multilingual CMS
≤4.9.7Update to 5.0.0
- High8.2Unauthenticated Arbitrary File Deletion via 'everest_forms_{form_id}_old_{field_id}' Parameter
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.6.2Update to 3.6.3
- High7.5Unauthenticated Arbitrary File Read via CF7 Field Value in mPDF WriteHTML SVG Parser
Ultra Addons for Contact Form 7
≤3.5.54Update to 3.5.55
- Medium5.3Companies and Users Management for WooCommerce <= 2.1.4 - Unauthenticated Sensitive Information Exposure in /wp/v2/aio_company REST Endpoint
Extend B2B - Companies and Users Management for WooCommerce
≤2.1.4No patch available
- Critical9.8Unauthenticated Remote Code Execution
STAGGS – Product Configurator Toolkit
≤3.3.0Update to 3.4.0
- High7.2Unauthenticated Stored Cross-Site Scripting
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.9.1Update to 3.9.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤5.5.2.8Update to 5.5.2.9
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤3.2.1Update to 3.2.2
- Medium4.7Authenticated (Administrator+) Privilege Escalation
Post Duplicator
<3.0.18Update to 3.0.18
- High7.2Unauthenticated Stored Cross-Site Scripting
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.202Update to 2.8.203
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Delivery & Pickup Date Time for WooCommerce
≤1.3.90Update to 1.3.91
- Medium5.3Unauthenticated Insecure Direct Object Reference
UniPAY Payment Gateway For WooCommerce
<2.4Update to 2.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Meta Box – A Framework for Dynamic Websites
≤5.15.3Update to 5.15.4
- Medium5.3Missing Authorization
FOX – Currency Switcher Professional for WooCommerce
≤1.5.6Update to 1.5.7
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.3.1Update to 5.3.2
- High7.3Unauthenticated Privilege Escalation
WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden
≤3.5.17Update to 3.5.18
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Activity Log
≤5.6.7Update to 5.6.8
- Medium6.5Authenticated (Subscriber+) SQL Injection
WP w3all phpBB
≤3.1.9Update to 3.2.0
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP
≤2.0.1Update to 2.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.8Update to 3.6.8.1
- High7.5Authenticated (Contributor+) Local File Inclusion
Travelly – Tour & Travel Booking Manager for WooCommerce
≤2.3.8Update to 2.3.10
- High7.5Authenticated (Author+) Local File Inclusion
Travelly – Tour & Travel Booking Manager for WooCommerce
≤2.3.8Update to 2.3.10
- Medium4.3Missing Authorization
Motors – Car Dealership & Classified Listings Plugin
≤1.4.128Update to 1.4.129