CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 97)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.34.3.0 - Unauthenticated Information Exposure
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
2.2.1 – 4.3.0Update to 4.3.1
- High7.52.0.20 - Unauthenticated SQL Injection
Unlimited Elements for Elementor
1.5.139 – 2.0.20Update to 2.0.21
- Medium5.3Unauthenticated Information Exposure
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤9.1Update to 9.2
- Medium4.9Authenticated (Editor+) Arbitrary File Read
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
≤4.2.2Update to 4.2.3
- High7.1Authenticated (Admin+) Arbitrary Directory Deletion
Prime Mover – Backup and Migration
≤2.2.0Update to 2.2.1
- Medium5.3Unauthenticated Persistent Denial of Service
WP Ultimate Review
≤2.4.3Update to 2.4.4
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Ultimate Review
≤2.4.3Update to 2.4.4
- Medium5.3Missing Authorization
Mailchimp for WooCommerce
≤6.2Update to 6.3
- Medium6.4Authenticated (Translator+) Stored Cross-Site Scripting
Loco Translate
≤2.8.8Update to 2.8.9
- High7.5Unauthenticated SQL Injection
SaveTo Wishlist Lite – WooCommerce Wishlist
≤1.1.4Update to 1.1.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Kubio AI Page Builder
≤2.9.2Update to 2.9.3
- Medium4.7Unauthenticated Arbitrary HTML Injection in Notification Emails
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤4.3.0Update to 4.3.1
- High7.2Authenticated (Admin+) Arbitrary File Write
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- Medium4.49.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
7.17 – 9.1Update to 9.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Horizontal scrolling announcements
≤2.6No patch available
- Medium4.3Unauthenticated Two-Factor Authentication Bypass
WP 2FA – Two-factor authentication for WordPress
≤4.0.0Update to 4.1.0
- High7.3Unauthenticated Captcha Verification Bypass
hCaptcha for WP
≤5.3.0Update to 5.4.0
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Prime Mover – Backup and Migration
≤2.2.0Update to 2.2.1
- High8.8Authenticated (Admin+) Arbitrary File Upload
Prime Mover – Backup and Migration
≤2.2.0Update to 2.2.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
WP Ultimate Review
≤2.4.3Update to 2.4.4
- High7.2Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2Update to 1.57.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
≤6.4.5Update to 6.4.6
- Medium6.1Reflected Cross-Site Scripting via 's' Search Parameter
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- High7.2Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2Update to 1.57.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields
PDF Invoices & Packing Slips for WooCommerce
≤5.16.1Update to 5.16.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Field
Business Essentials for Contact Form 7
≤1.2.1Update to 1.2.2
- High8.1Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
Super Forms – Drag & Drop Form Builder
≤6.3.316Update to 6.3.317
- Medium4.7Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤5.5.1.3Update to 5.5.1.4
- Medium6.1Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices()
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤5.5.1.3Update to 5.5.1.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name
bbp style pack
≤6.4.8Update to 6.4.9