CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 86)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Information Exposure
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.5Update to 7.4.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
bBlocks – Essential Gutenberg Blocks & Patterns Collection
≤2.1.8Update to 2.1.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Image Photo Gallery Final Tiles Grid
≤3.6.13Update to 3.6.14
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
≤3.0.0Update to 4.0.0
- Medium5.3Unauthenticated Mail Relay
Magee Shortcodes
≤2.1.1No patch available
- Critical9.8Unauthenticated Privilege Escalation
Tourfic Pro
≤1.17.3No patch available
- Medium5.37.6.2 - Missing Authorization
Nexi XPay Build
7.0.0 – 7.6.2No patch available
- Medium4.3Authenticated (Subscriber+) Information Exposure
User Private Files – Secure File Sharing and Client Portal Plugin
≤2.1.8Update to 2.1.9
- Medium4.34.2.14 - Authenticated (Subscriber+) Information Exposure
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
4.0.0 – 4.2.14Update to 4.2.15
- Medium5.3Missing Authorization
Fluent Forms Pro Add On Pack
≤6.2.13Update to 6.2.14
- Medium6.31.1.4 - Authenticated (Subscriber+) Privilege Escalation
Koinonia Link
1.1.2 – 1.1.4Update to 1.1.5
- Medium5.3Unauthenticated Information Exposure
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
≤3.0.20Update to 3.0.21
- Medium5.37.6.2 - Unauthenticated Payment Bypass
Nexi XPay Build
7.2.2 – 7.6.2No patch available
- Medium5.3Unauthenticated Login Protection Bypass
Advanced Google reCAPTCHA
≤5.40Update to 5.41
- Medium4.32-Factor Authentication Bypass
WP Synchro – The Ultimate WordPress Migration Tool
≤1.16.1Update to 1.16.2
- Medium5.3Missing Authorization to Unauthenticated Settings Update
TrueBooker – Appointment Booking and Scheduler System
≤1.2.9Update to 1.3.0
- Medium4.3Missing Authorization
Simple JWT Login – Allows you to use JWT on REST endpoints.
4.0.0 – 4.0.0No patch available
- Medium5.3Missing Authorization
Fluent Affiliate Pro
≤1.6.4Update to 1.6.5
- Medium5.3Missing Authorization
Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms
≤5.2.8No patch available
- Medium5.3Missing Authorization
Graphina – Charts and Graphs For Elementor
≤3.1.12Update to 3.1.13
- High8.1Authenticated (Contributor+) Arbitrary File Deletion
Job Postings
≤2.8.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Magee Shortcodes
≤2.1.1No patch available
- Medium4.3Missing Authorization
Unlimited Elements for Elementor
≤2.0.22Update to 2.0.23
- Medium4.3Missing Authorization
CP Media Player – Audio Player and Video Player
≤1.3.3Update to 1.3.4
- High7.24.5.1 - Authenticated (Editor+) Remote Code Execution
WP Coder – Insert & Manage Code Snippets
4.0 – 4.5.1Update to 4.5.2
- Medium4.9Authenticated (Editor+) SQL Injection
Animated Number Counters
≤3.0Update to 3.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.16.0Update to 1.16.1
- Medium4.3Authenticated (Contributor+) Protected Post Content Disclosure
Memberful – Membership Plugin
≤1.81.2Update to 1.82.0
- Medium5.33.1.0 - Unauthenticated Information Exposure
Geliver Akıllı Kargo Pazaryeri
3.0.0 – 3.1.0Update to 3.1.1
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
≤3.0.0Update to 4.0.0