CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 63)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Information Exposure
Document Gallery
≤5.1.1Update to 5.1.2
- Medium6.45.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Document Gallery
4.0 – 5.1.1Update to 5.1.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
MLS On The Fly
≤1.8.1.5No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Weaver Xtreme Theme Support
≤7.0.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
FV Simpler SEO
≤1.9.7Update to 1.9.8
- Medium4.3Missing Authorization
Download Monitor integration for WooCommerce
≤1.0.3Update to 1.0.4
- Medium5.3Unauthenticated Information Exposure
WPGraphQL
≤2.26.0Update to 2.26.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons
≤4.7.1Update to 4.7.2
- Medium5.3Missing Authorization
Booking for Appointments and Events Calendar – Amelia
≤2.4.10Update to 2.4.11
- Medium5.3Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.23Update to 2.9.24
- Medium5.3Missing Authorization
Pay for Payment for WooCommerce – Payment Gateway Fees & Discounts
≤3.0.1Update to 3.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.110Update to 4.11.111
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤3.1.0Update to 3.1.1
- Medium5.3Missing Authorization
FOX – Currency Switcher Professional for WooCommerce
≤1.5.4Update to 1.5.5
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium4.3Authenticated (Subscriber+) Information Exposure
Visual Form Builder
≤3.1No patch available
- Medium6.1Reflected Cross-Site Scripting
XStore
<9.7.9Update to 9.7.9
- Medium5.33.4.1 - Unauthenticated Arbitrary Order Status Manipulation
Cardinity Payment Gateway for WooCommerce
3.2.6 – 3.4.1Update to 3.4.2
- Medium4.3Cross-Site Request Forgery
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback
Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
≤2.10.6Update to 2.10.7
- Medium4.9Authenticated (Editor+) SQL Injection via 'counterid' Parameter
Animated Number Counters
≤3.0Update to 3.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤11.1.0Update to 11.1.1
- Medium4.3Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- Medium4.3Missing Authorization
WP-Members Membership Plugin
≤3.5.7Update to 3.5.8
- Medium5.3Missing Authorization
Skydropx
≤2.1.4Update to 2.1.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management
≤4.6.27Update to 4.6.28
- Medium6.1Reflected Cross-Site Scripting
Hippoo Mobile App for WooCommerce
≤1.12.0Update to 1.12.1
- Medium6.1Reflected Cross-Site Scripting
SimplyRETS Real Estate IDX
≤3.2.9Update to 3.3.0
- Critical9.8Unauthenticated Remote Code Execution
MDTF – Meta Data and Taxonomies Filter
≤1.3.9Update to 1.4.0
- Medium4.3Cross-Site Request Forgery
Patreon WordPress
≤1.9.17Update to 1.10.0