CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 99)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Authenticated (Contributor+) PHP Object Injection
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.46Update to 1.8.47
- Medium4.3Missing Authorization
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
≤4.2.14Update to 4.2.15
- High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine
≤3.8.15.3Update to 3.8.15.4
- Medium6.6Authenticated (Editor+) PHP Object Injection
Page Builder by SiteOrigin
≤2.36.0Update to 2.36.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.3Update to 3.15.5
- High7.2Unauthenticated Stored Cross-Site Scripting
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.13.1Update to 3.13.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
Pay with Vipps and MobilePay for WooCommerce
≤6.2.4Update to 6.2.5
- Critical9.8Unauthenticated Remote Code Execution
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤11.0.5Update to 11.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Persistent Login
≤3.1.3Update to 3.1.4
- High7.2Unauthenticated Stored Cross-Site Scripting
If-So Dynamic Content – Elementor & All Page Builders Personalization
≤1.10.1Update to 1.10.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Photo Album Plus
≤9.3.02.003Update to 9.3.03.002
- High7.2Unauthenticated Stored Cross-Site Scripting
Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key
≤1.5.5Update to 1.6.1
- High7.2Unauthenticated Stored Cross-Site Scripting
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
≤1.13.1Update to 1.13.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Easy Google Maps by Supsystic – Custom Markers, Clustering & Map Themes
≤1.14.6Update to 1.15.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.6Update to 11.2.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Premmerce Permalink Manager for WooCommerce
≤2.3.13Update to 2.3.16
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
CMB2
≤2.13.0Update to 2.13.1
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Newsletters, Email Marketing, SMS and Popups by Omnisend
≤1.9.0Update to 1.9.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Visual Composer Website Builder
≤45.16.2Update to 45.16.3
- Medium5.4Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
Advanced Woo Labels – Product Labels & Badges for WooCommerce
≤2.51Update to 2.52
- Medium4.9Authenticated (Administrator+) SQL Injection
WP Activity Log
≤5.6.6Update to 5.6.7
- Medium5.3Unauthenticated Information Exposure
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers
≤1.12.26Update to 1.12.27
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Cool FormKit Lite – Advanced Form Builder for Elementor
≤2.7.8Update to 2.7.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.86Update to 51.1.87
- Medium6.5Authenticated (Contributor+) SQL Injection
Event Tickets and Registration
≤5.29.5Update to 5.29.5.1
- Medium4.3Missing Authorization
The Events Calendar
≤6.17.5Update to 6.17.5.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Polylang
≤3.8.9Update to 3.8.10
- Medium5.3Unauthenticated Authentication Bypass
OAuth Single Sign On – SSO (OAuth Client)
≤7.1.2Update to 7.1.3
- Medium5.3Unauthenticated Information Exposure
Notivo Notification for WooCommerce
≤1.4.2Update to 1.4.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Virtue/Ascend/Pinnacle Toolkit
≤4.9.12.1Update to 4.9.12.2