CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 58)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.3Unauthenticated Arbitrary Order Status Manipulation
Paymentfor Gateway for WooCommerce
<1.0.6Update to 1.0.6
- Medium5.3Missing Authorization
SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster
<2.8.0Update to 2.8.0
- Medium4.3Cross-Site Request Forgery
Patreon WordPress
≤1.9.0Update to 1.10.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Donation Thermometer
<2.3.0Update to 2.3.0
- Medium6.5Authenticated (Contributor+) SQL Injection
BSK PDF Manager
<3.8.2Update to 3.8.2
- Medium4.3Authenticated (Subscriber+) Information Exposure
Tainacan
<1.4.0Update to 1.4.0
- High7.55.2.3 - Unauthenticated SQL Injection
Fast Courier – Shipping & Freight
5.0.0 – 5.2.3Update to 5.2.4
- Medium5.3Missing Authorization
Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant
<5.3.2Update to 5.3.2
- Medium5.3Missing Authorization
Trust Payments Gateway for WooCommerce
<3.1.0Update to 3.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Forms
<3.0.2Update to 3.0.2
- Medium6.47.5.55.7211 - Authenticated (Contributor+) Server-Side Request Forgery
FV Flowplayer Video Player
7.5.44.7212 – 7.5.55.7211Update to 7.5.55.7212
- Medium5.3Missing Authorization
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
<3.7.4Update to 3.7.4
- Medium4.9Authenticated (Editor+) SQL Injection
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
≤3.8.8Update to 3.8.9
- Low2.7Missing Authorization
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
≤4.3.3Update to 4.3.4
- Medium4.3Cross-Site Request Forgery
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.8Update to 10.31.9
- Medium5.3Missing Authorization
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.8Update to 10.31.9
- Medium6.5Authenticated (Contributor+) SQL Injection
CP Multi View Events Calendar
≤1.4.41Update to 1.4.42
- Low2.7Authenticated (Administrator+) Insecure Direct Object Reference
WP 2FA – Two-factor authentication for WordPress
<4.2.0Update to 4.2.0
- Medium5.3Missing Authorization
WP Encryption: One Click SSL / HTTPS & Free SSL certificate, HTTPS redirect
<7.8.8.2Update to 7.8.8.2
- Medium5.3Unauthenticated Payment Bypass
Visma Pay for Woocommerce
<1.2.2Update to 1.2.2
- High8.1Unauthenticated Local File Inclusion
Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform
<2.17.2Update to 2.17.2
- Medium5.38.0.5 - Missing Authorization
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
7.9.5 – 8.0.5Update to 8.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Booking System – Booking Calendar
<2.1.0.1Update to 2.1.0.1
- Medium4.3Missing Authorization
Classified Listing – AI-Powered Classified ads & Business Directory
<6.1.1Update to 6.1.1
- Medium5.39.3.0 - Unauthenticated Insecure Direct Object Reference
NEX-Forms – Ultimate Forms Plugin for WordPress
9.2.1 – 9.3.0Update to 9.3.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
CodeAtoZ B2B Suite for WooCommerce
<1.6.1Update to 1.6.1
- Medium6.44.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
4.10.1 – 4.10.5Update to 4.10.6
- Medium5.3Missing Authorization to Unauthenticated SEO Data Deletion
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.280Update to 1.0.280
- High7.5Unauthenticated Arbitrary File Read
Contact Form 7 Signature Addon
≤4.2.2No patch available
- Medium6.5Authenticated (Contributor+) SQL Injection
Ukr-To-Lat
≤1.3.5No patch available