CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 55)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.1Update to 1.58.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.1Update to 1.58.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via parser_callback
Broken Link Checker
≤2.4.14.1Update to 2.4.15
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow
Bulk Page Generator – LPagery
≤3.1.0Update to 3.1.1
- Medium6.5Authenticated (Custom+) SQL Injection via 'filters' Parameter
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
≤1.31.4Update to 1.31.5
- High7.5Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting
InstaWP Connect – 1-click WP Staging & Migration
≤0.1.4.1Update to 0.1.4.2
- High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint
Klarna for WooCommerce
≤4.13.3Update to 4.13.4
- Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML
Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy
≤1.2.0Update to 1.3.0
- High8.1Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.9.3Update to 4.9.4
- Medium6.1Reflected Cross-Site Scripting via 'permalink' Parameter
Gwolle Guestbook
≤5.1.1Update to 5.1.2
- High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
≤3.16.0.6Update to 3.17.0
- High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters
FluentCart – Online Store Builder & eCommerce Checkout
≤1.7.0Update to 1.7.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
Flying Scripts: Delay JavaScript to Improve Site Speed & Performance
≤1.2.4Update to 1.2.5
- Medium4.9Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys
FluentCart – Online Store Builder & eCommerce Checkout
≤1.7.0Update to 1.7.1
- High7.2Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
≤5.2.11Update to 5.2.12
- High8.1Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter
Customer Email Verification for WooCommerce
≤3.3.0Update to 3.3.1
- Medium4.3Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id}
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.2.1Update to 5.3.0
- Medium5.9Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link>
Debloat – Remove Unused CSS, Optimize JS
≤1.3.0Update to 1.4.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter
Complianz GDPR/CCPA Cookie Consent Banner
≤7.5.5Update to 7.5.6
- High7.2Unauthenticated Stored Cross-Site Scripting via Comments
Colibri Page Builder
≤1.0.390Update to 1.0.392
- High8.0Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation
Backuply – Backup, Restore, Migrate and Clone
≤1.5.8Update to 1.5.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute
Dark Mode – Improve Accessibility with AI Powered Dark Theme
≤5.3.17Update to 5.3.18
- Medium4.86.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
6.4.1 – 6.4.2Update to 6.4.3
- Medium5.3Unauthenticated Information Exposure
Gantry 5 Framework
≤5.6.4Update to 5.6.5
- Medium6.1Reflected Cross-Site Scripting
Fancy Comments WordPress
≤1.2.21No patch available
- Medium4.3Missing Authorization
Squeeze – Browser-Based Image Compression & WebP Converter (No API, No Limits)
≤1.8.0Update to 1.8.1
- Medium5.3Unauthenticated Reduced Booking Price
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
≤2.8.0Update to 2.8.1
- Medium5.3Unauthenticated Information Exposure
ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
≤3.12.0Update to 3.12.1
- Medium5.3Missing Authorization
PickPlugins Product Designer for WooCommerce
≤1.0.40No patch available
- Medium6.6Authenticated (Administrator+) PHP Object Injection
ACF Frontend Admin by DynamiApps
≤3.29.0Update to 3.30.0