CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 75)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Tennis WordPress Theme <= 1.12.0 - Unauthenticated PHP Object Injection
Smash - Tennis WordPress Theme
≤1.12.0No patch available
- High8.1Unauthenticated PHP Object Injection
Tantra | Yoga Studio and Fitness Club WordPress Theme
≤2.9.0No patch available
- High8.1Unauthenticated PHP Object Injection
Travesia | Travel Agency and Tour Booking WordPress Theme
≤1.1.16No patch available
- High8.1Unauthenticated PHP Object Injection
Buzz Stone | Magazine & Viral Blog WordPress Theme
≤1.0.2No patch available
- High8.1Unauthenticated PHP Object Injection
Photolia | Photo Company & Supply Store WordPress Theme
≤1.0.3No patch available
- Medium5.3Car Dealer, Rental & Listing WordPress theme <= 1.4.108 - Missing Authorization
Motors - Car Dealer, Rental & Listing WordPress theme
≤1.4.108No patch available
- High7.2Education WordPress Theme <= 3.4.2 - Unauthenticated Stored Cross-Site Scripting
Educavo - Education WordPress Theme
≤3.4.2No patch available
- Medium6.1Marketplace Mobile App Figma Template <= 3.3.9 - Reflected Cross-Site Scripting
Martfury - Marketplace Mobile App Figma Template
≤3.3.9No patch available
- High7.2Newspaper Magazine News BuddyPress AMP <= 7.6.7 - Unauthenticated Stored Cross-Site Scripting
Jannah - Newspaper Magazine News BuddyPress AMP
≤7.6.7Update to 7.6.8
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
YITH WooCommerce Affiliates
≤3.31.0Update to 3.31.1
- Medium4.3Missing Authorization
VillaTheme Core
≤1.0.5Update to 1.0.6
- Medium6.1Reflected Cross-Site Scripting
ThemeStek Extras for LabtechCO Theme
≤8.4No patch available
- Critical9.8Unauthenticated Arbitrary Account Takeover
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
≤4.0.0Update to 4.0.1
- Medium4.3Missing Authorization
Event Tickets and Registration
≤5.30.0.1Update to 5.30.0.2
- Medium5.3Missing Authorization
GiveWP – Donation Plugin and Fundraising Platform
≤4.18.0Update to 4.18.0.1
- High7.34.0.0 - Unauthenticated Privilege Escalation
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
3.9.6 – 4.0.0Update to 4.0.1
- Low2.74.0.0 - Authenticated (Administrator+) Information Exposure
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
3.6.4 – 4.0.0Update to 4.0.1
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments
<2.8.0Update to 2.8.0
- Medium4.3Missing Authorization
MemberHero – Simple User Registration & Login
≤6.9No patch available
- Medium6.1Reflected Cross-Site Scripting
Zeinet - Internet Provider & Satellite TV
≤1.0.0No patch available
- High8.1Unauthenticated PHP Object Injection
Balance
≤1.12.0No patch available
- High8.1Unauthenticated PHP Object Injection
Veto - Politics, Campaign & Candidate WordPress Theme
≤1.6.0No patch available
- Medium5.35.7.6 - Missing Authorization
BackWPup – WordPress Backup & Restore Plugin
3.3 – 5.7.6Update to 5.7.7
- Medium4.34.1.0 - Authenticated (Instructor+) Insecure Direct Object Reference
Tutor LMS – eLearning and online course solution
4.0.5 – 4.1.0Update to 4.1.1
- High8.1Unauthenticated PHP Object Injection
Original
≤1.9.0No patch available
- High8.1Unauthenticated Local File Inclusion
Ambient - Modern Interior Design and Decoration WordPress Theme
≤1.7No patch available
- High8.1Unauthenticated PHP Object Injection
Education Center | LMS & Online Courses WordPress Theme
≤3.6.12No patch available
- Medium5.3Unauthenticated Information Exposure
YITH WooCommerce Product Add-Ons
≤4.34.0Update to 4.34.1
- Medium4.3Cross-Site Request Forgery
WP 2FA – Two-factor authentication for WordPress
≤4.1.0Update to 4.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Plugin Info Card – Showcase Beautiful Plugin Cards, Theme Cards, and GitHub Repos Anywhere
≤6.3.5Update to 6.4.0