CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 87)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
Frontend Dashboard
≤2.0.0Update to 3.0.0
- Medium5.3Missing Authroization
E-cab Taxi Booking Manager for Woocommerce
≤2.1.1Update to 2.1.2
- Medium5.34.11.1 - Missing Authorization
Integration for Epos Now and WooCommerce
4.6.0 – 4.11.1Update to 4.11.2
- Medium6.411.17.9 - Authenticated (Contributor+) Server-Side Request Forgery
PowerPress Podcasting plugin by Blubrry
11.13.12 – 11.17.9Update to 11.17.11
- Medium5.3Unauthenticated Login Lockout Protection Bypass
Login Lockdown & Protection
≤2.17Update to 2.18
- High8.1Unauthenticated PHP Object Injection
String locator
≤2.6.7Update to 2.6.8
- Medium5.3Missing Authorization
CURCY – Multi Currency for WooCommerce
≤2.2.17Update to 2.2.18
- High7.2Unauthenticated Stored Cross-Site Scripting
Fluent Forms Pro Add On Pack
≤6.2.13Update to 6.2.14
- Medium6.11.10.1 - Reflected Cross-Site Scripting
If-So Dynamic Content – Elementor & All Page Builders Personalization
1.4.4 – 1.10.1Update to 1.10.2
- Medium5.3Missing Authorization to Unauthenticated Settings Change
PayPlug for WooCommerce (Official)
≤3.1.0Update to 3.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
WooCommerce Simple Auctions
≤3.0.10No patch available
- High7.5Functionality <= 3.9.3 - Unauthenticated SQL Injection
Porto Theme - Functionality
≤3.9.3No patch available
- Critical9.1Unauthenticated Arbitrary File Deletion
Simple File List
≤6.3.11No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
BuddyBoss Platform
≤3.1.0No patch available
- High8.8Authenticated (Employer / Sales Representative+) Arbitrary File Upload
Workreap Core
≤3.4.5No patch available
- Medium6.1Professional LMS Education Center WordPress Theme <= 4.5.3 - Reflected Cross-Site Scripting
EduMall - Professional LMS Education Center WordPress Theme
≤4.5.3No patch available
- Medium6.1Reflected Cross-Site Scripting
WPLMS Learning Management System for WordPress, WordPress LMS
≤4.972No patch available
- High7.2Unauthenticated Server-Side Request Forgery
Builderius – Landing Page Builder + Dynamic Templates
≤1.4-betaUpdate to 1.5-rc1
- Medium6.4Authenticated (Instructor+) Stored Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.9.1Update to 4.4.10
- Medium5.3Unauthenticated Spam Protection Bypass on Login
Zero Spam for WordPress
≤5.7.11Update to 5.7.12
- Medium4.9Authenticated (Editor+) SQL Injection
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
≤4.2.2Update to 4.2.3
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.16.0Update to 1.16.1
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Yaad Sarig Payment Gateway For WC
≤2.2.12Update to 2.2.13
- High8.8Authenticated (Subscriber+) Remote Code Execution
WooCommerce Designer Pro
≤1.9.33No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Ohio Extra
≤3.6.8No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
Mooberry Book Manager
4.16.2 – 4.16.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Smart Forms – when you need more than just a contact form
≤2.6.104No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Frontend File Manager Plugin
≤23.6No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
SUMO Affiliates Pro
≤11.7.0No patch available
- Medium4.3Authenticated (Customer+) Insecure Direct Object Reference
Faktur Pro for WooCommerce
≤3.2.2Update to 3.2.3