VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 94)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

Severity
Signals
Software

41,175 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 94)
SeverityVulnerabilityCVEInstallsPublished
Medium6.1Reflected DOM-Based Cross-Site Scripting via URL Pathname
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)≤5.0.1.1Update to 5.0.2
CVE-2026-85492—
High7.2Unauthenticated Stored Cross-Site Scripting via '_rt' Parameter
Relevanssi Premium≤2.31.4Update to 2.31.5
CVE-2026-103426—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
Relevanssi – A Better Search≤4.28.3Update to 4.28.4
CVE-2026-97641—
Low3.1Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE≤3.2.6Update to 3.2.7
CVE-2026-102002—
High7.2Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter
Newsletter – Send awesome emails from WordPress≤9.4.0Update to 9.4.1
CVE-2026-96566—
High7.2Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta)
MW WP Form≤5.1.7Update to 5.1.8
CVE-2026-96567—
High7.2Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect
No External Links≤5.2.0Update to 5.3.0
CVE-2026-95670—
High7.2Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter
Mang Board≤2.4.2Update to 2.4.3
CVE-2026-96871—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'lsd[remark]' Parameter
Listdom: AI-powered Business Directory with Classifieds Ads Listings≤6.1.1Update to 6.1.2
CVE-2026-96647—
Medium5.3Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.7.1Update to 5.7.2
CVE-2026-94432—
High7.2Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)
Kubio AI Page Builder≤2.9.2Update to 2.9.3
CVE-2026-100107—
Critical9.8Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response
JSON API Auth≤3.1.2Update to 3.1.3
CVE-2026-97637—
High7.2Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action
JetFormBuilder — Dynamic Blocks Form Builder≤3.6.5.4Update to 3.6.6
CVE-2026-97342—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
GSpeech TTS – WordPress Text To Speech Plugin≤3.22.0Update to 3.22.1
CVE-2026-96578—
High7.2Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress≤4.13.0Update to 4.14.0
CVE-2026-93756—
Medium6.1Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder
Greenshift – animation and page builder blocks≤13.2.0Update to 13.2.1
CVE-2026-93880—
Medium6.5Authenticated (Contributor+) SQL Injection via 'orderby' Parameter
Event Tickets and Registration≤5.29.5Update to 5.29.5.1
CVE-2026-97634—
High7.2Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor
Download Monitor≤5.2.10Update to 5.2.11
CVE-2026-100182—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
Download Manager≤3.3.70Update to 3.3.71
CVE-2026-97338—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
DoFollow Case by Case≤3.6.0Update to 3.6.1
CVE-2026-95817—
Medium6.5Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions≤5.0.18Update to 5.0.19
CVE-2026-12951—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Author Name
Customer Reviews for WooCommerce≤5.122.0Update to 5.123.0
CVE-2026-97663—
High7.2Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field
CMB2≤2.13.1Update to 2.13.2
CVE-2026-102772—
High7.2Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type
CMB2≤2.13.0Update to 2.13.1
CVE-2026-97336—
High7.2Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' Parameter
BA Book Everything≤1.8.28Update to 1.8.29
CVE-2026-102565—
High7.2Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.15.4Update to 3.15.5
CVE-2026-90438—
High8.1File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload
Ninja Forms - File Uploads≤3.3.34Update to 3.3.35
CVE-2026-92820—
High7.2Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter
JetAppointment≤2.5.2.1Update to 2.5.3
CVE-2026-93875—
Medium5.4Unauthenticated Stored Cross-Site Scripting via Comment Author Name
Autoptimize≤3.1.15.1Update to 3.1.16
CVE-2026-78471—
Medium6.1Reflected Cross-Site Scripting via 'lang' Parameter
Avada | Website Builder For WordPress & WooCommerce≤7.16.1Update to 7.16.2
CVE-2026-84925—

Search VulnCrest Radar

Jump to

Are you sure?