VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 59)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

Severity
Signals
Software

41,172 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 59)
SeverityVulnerabilityCVEInstallsPublished
High7.5Unauthenticated SQL Injection
Walletdoc Payment Gateway for WooCommerce<1.8.5Update to 1.8.5
CVE-2026-103307—
High7.3Unauthenticated Snippet Safe Mode Bypass
WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager<2.4.0Update to 2.4.0
CVE-2026-101301—
Critical9.8Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications≤3.10.0Update to 3.10.1
CVE-2026-104748—
High7.2Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter
Record of Consent Extension for Complianz≤2.5Update to 2.6
CVE-2026-107631—
High8.1Unauthenticated Local File Inclusion via 'billing.first_name' Parameter
ShopMagic – email automation for WordPress≤4.9.0Update to 4.9.1
CVE-2026-103367—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PeproDev Branches Map (Mapify)≤3.0.1Update to 3.0.2
CVE-2025-9373—
High7.2Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter
Post Export Import with Media≤1.17.1Update to 1.17.2
CVE-2026-104764—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name
Meow Lightbox≤5.6.2Update to 5.6.3
CVE-2026-107756—
High8.1Unauthenticated Local File Inclusion via '<mode>_type' Parameter
Mang Board≤2.4.3Update to 2.4.4
CVE-2026-104909—
High7.2Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter
Mang Board≤2.4.3Update to 2.4.4
CVE-2026-107751—
Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Parameter
Mang Board≤2.4.3Update to 2.4.4
CVE-2026-104761—
High7.5Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes≤10.3.1Update to 10.3.2
CVE-2026-110284—
Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress≤3.2.19Update to 3.2.20
CVE-2026-103907—
High7.4Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.7.2Update to 5.7.3
CVE-2026-100163—
High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.7.3Update to 5.7.4
CVE-2026-103366—
Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.7.3Update to 5.7.4
CVE-2026-103380—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory≤2.8.190Update to 2.8.191
CVE-2026-107650—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory≤2.8.190Update to 2.8.191
CVE-2026-107754—
Medium4.9Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body
Gallery Custom Links≤2.3.3Update to 2.3.4
CVE-2026-107757—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX
Social Share Buttons & Analytics Plugin – GetSocial.io≤4.5No patch available
CVE-2026-103369—
High7.2Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String
NewStatPress≤1.4.5No patch available
CVE-2026-101924—
Medium6.5Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter
Hyyan Integration for WooCommerce and Polylang≤1.5.0No patch available
CVE-2026-101926—
High7.2Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field)
NewStatPress≤1.4.5No patch available
CVE-2026-100153—
High7.5Unauthenticated SQL Injection via 'gmedia__in' Parameter
Gmedia Photo Gallery≤1.25.1No patch available
CVE-2026-96661—
High7.2Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter
Smart Forms – when you need more than just a contact form≤2.6.104No patch available
CVE-2026-95816—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute
Countdown Timer – Widget Countdown3.0.0 – 3.0.1No patch available
CVE-2026-16495—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podata' Parameter
PO/MO Editor≤1.4.2No patch available
CVE-2026-97020—
High7.5Unauthenticated SQL Injection
JTL-Connector for WooCommerce≤2.4.3No patch available
CVE-2026-78193—
High7.2Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire)
Verified Reviews (Avis Vérifiés)≤2.4.6No patch available
CVE-2026-94377—
High7.2Unauthenticated Stored Cross-Site Scripting via data_object Parameter
Cryptocurrency Donation Box – Bitcoin & Crypto Donations≤2.2.13No patch available
CVE-2026-93885—

Search VulnCrest Radar

Jump to

Are you sure?