CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 57)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Arbitrary Payment Status Manipulation
CamPay Shortcode Payment Gateway
<1.7Update to 1.7
- Medium5.3Missing Authorization
AWP Classifieds
<4.4.9Update to 4.4.9
- High8.1Unauthenticated PHP Object Injection
Gravity Forms
<3.1.1Update to 3.1.1
- Medium6.1Reflected Cross-Site Scripting
Houzez
≤4.4.0Update to 4.4.1
- High7.5Unauthenticated SQL Injection
Green Popups
<7.6.3Update to 7.6.3
- Medium5.32.5.2 - Missing Authorization
Sifalo Pay
2.0 – 2.5.2Update to 2.5.3
- Medium5.32.5.2 - Missing Authorization
Sifalo Pay
2.0 – 2.5.2Update to 2.5.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
rtMedia for WordPress, BuddyPress and bbPress
<4.7.14Update to 4.7.14
- Medium4.7Unauthenticated Open Redirect
Patreon WordPress
≤1.9.0Update to 1.10.0
- Medium4.3Missing Authorization
YITH WooCommerce Popup
<1.60.0Update to 1.60.0
- Medium5.3Unauthenticated Arbitrary Order Payment Confirmation
Tickera – Sell Tickets & Manage Events
<3.6.0.4Update to 3.6.0.4
- Medium5.32.0.2.1 - Unauthenticated Payment Bypass on Paid Forms
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
1.10.0.1 – 2.0.2.1Update to 2.0.2.2
- Medium5.3Unauthenticated Arbitrary Order Status Manipulation
Asaas Gateway for WooCommerce
<2.7.8Update to 2.7.8
- High8.8Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter
Email Customizer for WooCommerce (Pro)
≤3.9.5Update to 3.9.6
- Medium5.4Unauthenticated Limited Privilege Escalation via 'process_registration'
WholesaleX – Wholesale Pricing & B2B Solution
≤3.0.8Update to 3.0.9
- Medium5.3Unauthenticated Information Exposure
bbPress
<2.6.19No patch available
- Medium5.3Missing Authorization
Restricted Site Access
≤7.6.2Update to 7.6.3
- Medium4.3Authenticated (Contributor+) Information Exposure
Product Delivery Date for WooCommerce – Lite
≤3.3.1Update to 3.3.2
- Medium4.3Missing Authorization
MB Custom Post Types & Custom Taxonomies
≤2.12.1Update to 2.12.2
- Critical9.8Unauthenticated Account Takeover
OTP Login & Register Woocommerce
≤2.7.2Update to 2.7.3
- Medium6.5Insufficient Authorization to Booking API Access
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.8Update to 10.31.9
- Medium4.3Missing Authorization
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
<8.0.6Update to 8.0.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Image Photo Gallery Final Tiles Grid
<3.6.16Update to 3.6.16
- High7.2Unauthenticated Stored Cross-Site Scripting
LTL Freight Quotes – ODFL Edition
<4.2.19Update to 4.2.19
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Gutenverse Form – Contact Form Builder, Block Form & Booking Form
<3.0.11Update to 3.0.11
- Medium5.3Unauthenticated Information Exposure
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
<5.5.84Update to 5.5.84
- Medium5.3Missing Authorization
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
<5.5.77Update to 5.5.77
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Image Photo Gallery Final Tiles Grid
<3.6.15Update to 3.6.15
- Medium4.7Unauthenticated Arbitrary HTML Injection in Notification Email
Responsive Blocks – Page Builder for Blocks & Patterns
<2.3.0Update to 2.3.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails
<2.1.4Update to 2.1.4