CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 65)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated PHP Object Injection
Mission
≤1.22No patch available
- High8.1Unauthenticated PHP Object Injection
Le Truffe
≤1.1.7No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Easy Property Listings
≤3.5.25Update to 3.5.26
- Medium5.3Unauthenticated Race Condition
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.8No patch available
- High8.1Unauthenticated PHP Object Injection
Affiliates
≤7.0.1Update to 7.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine
≤3.8.16Update to 3.8.16.1
- Medium5.3Missing Authorization
WP OAuth Server ( Login with WordPress )
≤6.4.0Update to 6.5.0
- Medium5.3Missing Authorization
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.6Update to 3.6.6.1
- Medium5.3Missing Authorization
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.12Update to 7.5.13
- Medium4.3Missing Authorization
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.12Update to 7.5.13
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Frontend Dashboard
≤3.0.7Update to 3.0.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP w3all phpBB
≤3.1.0Update to 3.1.2
- High7.5Authenticated (Custom Role+) PHP Object Injection
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.3Update to 4.9.4
- Medium6.5Authenticated (Subscriber+) SQL Injection
Modern Events Calendar Lite
<7.37.0Update to 7.37.0
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Disclosure
Booster Elite for WooCommerce
<8.4.0Update to 8.4.0
- Medium6.1Reflected Cross-Site Scripting
Marin
≤0.1.1Update to 0.1.2
- Critical9.1Unauthenticated Arbitrary File Deletion
File Upload to Order for WooCommerce
≤1.1.3Update to 1.1.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.12Update to 7.5.13
- Medium5.3Unauthenticated Session Hijacking
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.2Update to 7.3.3
- Medium5.3Missing Authorization
Flexible Quantity & Price Calculator for WooCommerce
≤2.3.22Update to 2.3.23
- High7.2Unauthenticated Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.3Update to 4.9.4
- Medium6.5Unauthenticated Arbitrary Shortcode Injection
Mailonix – Email Template Customizer for WooCommerce
≤1.3.4Update to 1.3.5
- High7.3Unauthenticated Arbitrary Shortcode Execution
Salevo Boost Sales for WooCommerce – Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon
≤1.3.0Update to 1.3.1
- High8.1Unauthenticated PHP Object Injection
Gunslinger
≤1.11No patch available
- High8.1Gaming Metaverse Game & Crypto WordPress Theme <= 1.19 - Unauthenticated PHP Object Injection
Gamic - Gaming Metaverse Game & Crypto WordPress Theme
≤1.19No patch available
- High8.1Unauthenticated PHP Object Injection
EmojiNation
≤1.0.12No patch available
- High8.1Unauthenticated PHP Object Injection
Coinpress
≤1.0.15No patch available
- High8.1Unauthenticated PHP Object Injection
Avventure
≤1.1.12No patch available
- High8.1Unauthenticated PHP Object Injection
Orpheus
≤1.8No patch available
- High8.1Music Festival & Concert WordPress Theme <= 1.15 - Unauthenticated PHP Object Injection
Muzicon - Music Festival & Concert WordPress Theme
≤1.15No patch available