VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 66)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

Severity
Signals
Software

41,175 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 66)
SeverityVulnerabilityCVEInstallsPublished
High8.1Unauthenticated PHP Object Injection
Motorix≤1.11No patch available
CVE-2026-62004—
High8.1Unauthenticated PHP Object Injection
Meals & Wheels≤1.1.13No patch available
CVE-2026-62002—
High8.1Personal Blog & Magazine WordPress Theme <= 1.2.14 - Unauthenticated PHP Object Injection
Marcell - Personal Blog & Magazine WordPress Theme≤1.2.14No patch available
CVE-2026-62001—
High8.1Unauthenticated PHP Object Injection
Legal Stone | Lawyers & Attorneys WordPress Theme≤1.2.11No patch available
CVE-2026-61997—
High7.2Unauthenticated Stored Cross-Site Scripting
Auction Nudge – Your eBay Listings≤8.4.0No patch available
CVE-2026-61988—
High7.2Unauthenticated Stored Cross-Site Scripting
JetProductTables≤1.2.4Update to 1.2.4.1
CVE-2026-107867—
Medium4.37.1 - Missing Authorization
WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments6.1 – 7.1Update to 7.2
CVE-2026-107791—
Medium4.3Missing Authorization
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions≤5.0.19No patch available
CVE-2026-108695—
Medium4.3Missing Authorization
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce≤2.2.4Update to 2.2.5
CVE-2026-103685—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
HireZoot – Job Listings, Career Page & Recruitment Tool≤3.0.0Update to 4.0.0
CVE-2025-15703—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute
PeproDev Ultimate Profile Solutions≤8.2.36Update to 8.2.37
CVE-2026-4791—
High7.2Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
HivePress – Business Directory, Listings & Classified Ads Plugin≤1.7.31Update to 1.7.32
CVE-2026-107657—
Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter
Listdom: AI-powered Business Directory with Classifieds Ads Listings≤6.1.2Update to 6.2.0
CVE-2026-104722—
High7.5Unauthenticated Arbitrary File Read via 'svg_image' Parameter
Divi Plus≤2.4.0Update to 2.4.1
CVE-2026-91136—
High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute
Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress≤5.2.12Update to 5.3.0
CVE-2026-101920—
High7.2Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout≤3.16.0.5Update to 3.16.0.6
CVE-2026-100147—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI≤5.8.4Update to 5.8.5
CVE-2026-104728—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field
Avada | Website Builder For WordPress & WooCommerce≤7.16.1Update to 7.16.2
CVE-2026-97340—
High7.2Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter
WPAdverts – Classifieds Plugin≤2.3.4Update to 2.3.5
CVE-2026-100178—
High7.5Unauthenticated SQL Injection via 'booking[service_id]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.7.2Update to 5.7.3
CVE-2026-96662—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint
Email Marketing for WordPress and WooCommerce – Retainful≤1.0.10Update to 1.0.11
CVE-2026-97396—
Medium6.4Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content
SureDash – Community, Courses & Member Dashboard≤1.12.1Update to 1.12.2
CVE-2026-1027741K+
High7.2Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)≤44.1Update to 45.0
CVE-2026-96765—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter
Motors – Car Dealership & Classified Listings Plugin≤1.4.124Update to 1.4.125
CVE-2026-96563—
High7.5Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels≤5.0.2Update to 5.0.3
CVE-2026-93746—
High8.1Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)≤44.1Update to 45.0
CVE-2026-104759—
Medium4.7Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More≤2.0.2.1Update to 2.0.2.2
CVE-2026-101921—
Medium6.5Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)
WP Directory Kit≤1.5.9Update to 1.6.0
CVE-2026-96653—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter
Premium Packages – Sell Digital Products Securely≤7.2.6Update to 7.2.7
CVE-2026-103478—
Critical9.8Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback
WPCOM Member≤1.7.27Update to 1.8.0
CVE-2026-104803—

Search VulnCrest Radar

Jump to

Are you sure?