VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 98)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

Severity
Signals
Software

41,175 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 98)
SeverityVulnerabilityCVEInstallsPublished
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action
Awesome Support – WordPress HelpDesk & Support Plugin≤6.4.0Update to 6.4.1
CVE-2026-96268—
High7.2Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path
Autoptimize≤3.1.15.1Update to 3.1.16
CVE-2026-14995—
High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer
Appointment Hour Booking – Booking Calendar≤1.5.97Update to 1.5.98
CVE-2026-96573—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field
Redux Framework≤4.5.14Update to 4.5.15
CVE-2026-90992—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' Parameter
Duplicate Post≤1.5.6Update to 1.5.7
CVE-2026-89424—
High7.2Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder≤1.15.47Update to 1.15.48
CVE-2026-96813—
High8.8Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint
WPC Shop as a Customer for WooCommerce≤2.0.0Update to 2.0.1
CVE-2026-95687—
Medium6.1Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)
Ad Inserter – Ad Manager & AdSense Ads≤2.8.18Update to 2.8.19
CVE-2026-19902—
High8.8Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool
ByteCoreStack – MCP Connector for AI Tools≤1.2.3Update to 1.2.4
CVE-2026-19807—
Critical9.8Unauthenticated Privilege Escalation via 'role' Parameter
Super Forms – Drag & Drop Form Builder≤6.3.316Update to 6.3.317
CVE-2026-15989—
Critical9.8Unauthenticated Authentication Bypass via 'checkout_form' Parameter
Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform≤2.15.0Update to 2.15.1
CVE-2026-75957—
Medium6.1Reflected DOM-Based Cross-Site Scripting via URL
Social Media Share Buttons & Social Sharing Icons≤3.0.1Update to 3.0.2
CVE-2026-89047—
High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses≤4.4.8Update to 4.4.9
CVE-2026-93882—
High7.2Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key
Extendify≤3.1.6Update to 3.2.0
CVE-2026-85679—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter
Redux Framework≤4.5.14Update to 4.5.15
CVE-2026-88999—
Critical9.1Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress≤5.7.0Update to 5.7.1
CVE-2026-92966—
Medium5.3Unauthenticated Information Disclosure in 'post_type' and 'context' Parameters
WP Popular Posts≤7.4.2Update to 7.4.3
CVE-2026-92548—
High7.2Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini≤3.8.0Update to 3.8.1
CVE-2026-96561—
Medium6.5Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter
Simply Schedule Appointments≤1.6.12.31Update to 1.6.12.33
CVE-2026-91109—
High7.5Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce
Simply Schedule Appointments≤1.6.12.32Update to 1.6.12.33
CVE-2026-92245—
Medium5.3Missing Authorization
Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key≤1.5.5Update to 1.6.1
CVE-2026-102397—
High7.2Unauthenticated Stored Cross-Site Scripting
Photonic Gallery & Lightbox for Flickr, SmugMug & Others≤3.36Update to 3.37
CVE-2026-97290—
High7.2Unauthenticated Stored Cross-Site Scripting
CURCY – Multi Currency for WooCommerce2.2.18 – 2.2.18Update to 2.2.19
CVE-2026-94171—
Medium5.3Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)
Newsletter – Send awesome emails from WordPress≤9.3.9Update to 9.4.0
CVE-2026-92537—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Branda – White Label & Branding, Free Login Page Customizer≤3.4.32Update to 3.4.33
CVE-2026-102376—
Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Extra Product Options For WooCommerce | Custom Product Addons and Fields≤3.3.8Update to 3.3.9
CVE-2026-102392—
High7.2Unauthenticated Stored Cross-Site Scripting
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor≤1.27.14Update to 1.27.15
CVE-2026-100510—
High7.2Unauthenticated Stored Cross-Site Scripting
JetFormBuilder — Dynamic Blocks Form Builder≤3.6.5.4Update to 3.6.6
CVE-2026-102391—
High7.5Authenticated (Contributor+) PHP Object Injection
Nested Pages≤3.3.2Update to 3.3.3
CVE-2026-100512—
High7.5Authenticated (Contributor+) PHP Object Injection
Schema & Structured Data for WP & AMP≤1.66Update to 1.67
CVE-2026-97291—

Search VulnCrest Radar

Jump to

Are you sure?