CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 64)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
Patreon WordPress
≤1.10.0Update to 1.11.0
- Medium5.3Missing Authorization
Salevo Boost Sales for WooCommerce – Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon
≤1.3.0Update to 1.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.110Update to 4.11.111
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.7Update to 11.2.8
- Medium5.3Missing Authorization
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.0Update to 1.58.1
- Medium4.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.28Update to 1.0.29
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤8.8.8Update to 8.8.9
- Medium4.3Missing Authorization
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.6Update to 7.3.7
- Medium4.3Missing Authorization
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.13Update to 7.5.14
- Medium5.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.28Update to 1.0.29
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetMenu
≤3.0.5Update to 3.0.5.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
≤2.9.2.3Update to 2.9.2.4
- Medium4.3Missing Authorization
Flexible Subscriptions
≤1.8.4Update to 1.8.5
- Medium4.3Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.22Update to 2.9.23
- Medium5.3Missing Authorization
Products Restricted Users for WooCommerce
≤0.7Update to 0.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Custom Query Blocks
≤5.6.0Update to 5.7.0
- Medium4.3Missing Authorization
Event Post
≤6.1.1Update to 6.1.2
- Medium4.3Missing Authorization
TMDS – Dropshipping for TEMU and Woo
≤1.0.15Update to 1.0.16
- Medium4.3Missing Authorization
VideoWhisper Site Manager for ChatGPT, Claude, Codex, Grok
≤1.2.10Update to 1.2.11
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Event Post
≤6.1.1Update to 6.1.2
- Medium5.3Missing Authorization
Bus Ticket Booking with Seat Reservation
≤5.9.7Update to 5.9.8
- Medium5.3Missing Authorization
Push Notification for Post and BuddyPress
≤3.23Update to 3.24
- Medium6.6Authenticated (Editor+) PHP Object Injection
Polylang
≤3.8.9Update to 3.8.10
- High8.1Real Estate WordPress Theme <= 1.3.13 - Unauthenticated PHP Object Injection
Good Homes - Real Estate WordPress Theme
≤1.3.13No patch available
- High8.1Unauthenticated PHP Object Injection
gamezone
≤1.1.11No patch available
- High8.1Unauthenticated PHP Object Injection
Edge Decor
≤2.9No patch available
- High8.1Unauthenticated PHP Object Injection
Bonbon
≤1.11No patch available
- High8.1Unauthenticated PHP Object Injection
Filmax | Cinema & Movie News Magazine WordPress Theme
≤1.1.11No patch available
- High8.1Unauthenticated PHP Object Injection
Nuts
≤1.12No patch available