CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 62)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated Arbitrary File Upload
WP-BusinessDirectory – Business directory plugin for WordPress
≤4.0.2No patch available
- Medium5.35.1.1 - Unauthenticated Document Thumbnail Replacement
Document Gallery
4.1 – 5.1.1Update to 5.1.2
- Medium6.1Reflected Cross-Site Scripting
Document Gallery
≤5.1.1Update to 5.1.2
- Critical9.8Unauthenticated Remote Code Execution
AjaxLoadMore Cache
≤3.1.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
IMPress for IDX Broker
≤3.3.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Responsive Slider
≤0.1.9No patch available
- High8.1Unauthenticated PHP Object Injection
Quirky - NFT, Token & Artist Marketplace WordPress Theme
≤1.23No patch available
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.25Update to 4.1.26
- Medium5.3Missing Authorization
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.110Update to 4.11.111
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.4Update to 4.9.5
- Medium4.3Missing Authorization
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
≤2.1.0Update to 2.2.0
- Medium4.9Authenticated (Editor+) SQL Injection
Link Whisper Free
≤0.9.7Update to 0.9.8
- High7.3Unauthenticated Privilege Escalation
User Rights Access Manager
≤1.1.3No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.12.7Update to 2.12.8
- Medium5.3Missing Authorization
Quick PayPal Payments: Payment Button & Form
≤6.0.3Update to 6.0.4
- Medium5.3Unauthenticated Information Exposure
Active Woot Products Tables for WooCommerce. 100% FREE
≤2.1.3Update to 2.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Books Gallery – Book Showcase, Library & Affiliate Plugin
≤4.8.4Update to 4.8.5
- Medium4.9Authenticated (Editor+) SQL Injection
WOLF – WordPress Posts Bulk Editor and Manager Professional
≤1.1.1Update to 1.1.2
- Medium5.3Unauthenticated Information Exposure
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium5.3Missing Authorization
Spin Wheel – Interactive spinning wheel that offers coupons
≤2.2.0Update to 2.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium4.3Missing Authorization
Easy HTTPS Redirection (SSL)
≤2.0.1Update to 2.0.2
- High7.5Unauthenticated SQL Injection
Mobile builder
≤1.4.2No patch available
- Medium5.3Unauthenticated Payment Bypass
Coinbase Commerce Payment Gateway for WooCommerce
≤1.4.1No patch available
- Medium5.3Missing Authorization
eaSYNC Booking – Hotels, Restaurants & Car Rentals
≤1.3.30Update to 1.3.31
- Medium5.3Unauthenticated Arbitrary HTML Attribute Injection
Broken Link Checker
≤2.4.14.1Update to 2.4.15
- Medium5.3Missing Authorization
Tutor LMS – eLearning and online course solution
≤4.1.0Update to 4.1.1
- High7.35.5.2 - Unauthenticated Arbitrary Order Status Modification
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit
3.7.1 – 5.5.2Update to 5.5.3
- Medium5.3Unauthenticated Information Exposure
Coinsnap Bitcoin Crowdfunding
≤1.2.0No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
WP Testimonials
≤1.4.13No patch available