CWE-98Vulnerability type
WordPress Local File Inclusion vulnerabilities (page 1245)
Template or module loaders that include attacker-chosen files, often leading to code execution.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Authenticated Stored Cross-Site Scripting
iQ Block Country
≤1.2.11Update to 1.2.12
- Medium6.4Unprotected REST-API to Email Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.5.7Update to 3.5.8
- Medium6.5Unprotected REST-API to Sensitive Information Disclosure
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.5.7Update to 3.5.8
- Medium5.4Contributor+ Stored Cross-Site Scripting
Easy Media Download
≤1.1.5Update to 1.1.7
- High7.5Arbitrary User Password Reset
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.6.2Update to 2.6.3
- Medium4.8Admin+ Stored Cross-Site Scripting
Cookie Bar
≤1.8.8Update to 1.8.9
- Medium5.4Cross-Site Scripting
Video Player for YouTube – Embed Videos Your Visitors Will Love to Watch
<1.4Update to 1.4
- Medium5.8Open Relay and Server-Side Request Forgery
Telefication
≤1.8.0No patch available
- Medium4.8Vimeo and YouTube Gallery < 1.1.5 - Stored Cross-Site Scripting
Video Gallery – Vimeo and YouTube Gallery
<1.1.5Update to 1.1.5
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting
WP HTML Author Bio
≤1.2.0No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Responsive WordPress Slider
≤2.2.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
Game Server Status
≤1.0No patch available
- High7.5Unauthenticated Arbitrary Post Deletion
WP DSGVO Tools (GDPR)
≤3.1.23Update to 3.1.24
- Medium4.8Stored Cross-Site Scripting
Request a Quote – Quote Forms for Any WordPress Site
<2.3.5Update to 2.3.5
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
St-Daily-Tip
≤4.7No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Special Text Boxes
≤5.9.109Update to 5.9.110
- High8.8Cross-Site Request Forgery
jQuery Reply to Comment
≤1.31No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Frontend Uploader
≤1.3.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation
≤2.6.0Update to 2.6.1
- Medium6.5Cross-Site Request Forgery to Cross-Site Scripting
Wp Cookie Choice
≤1.1.0No patch available
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
微信打赏（Wechat Reward）
≤1.7No patch available
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
Polo Video Gallery – Best wordpress video gallery plugin
≤1.2No patch available
- Medium5.4Cross-Site Scripting
StreamCast – bring live radio to your site with a sleek player
<2.1.1Update to 2.1.1
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Sociable
≤4.3.4.1No patch available
- Medium4.8Authenticated Stored Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.1.3Update to 4.1.3.1
- Medium6.1Reflected Cross-Site Scripting
GamePress – The Game Database Plugin
≤1.1.0No patch available
- High7.2Admin+ SQL Injection
MainWP Child Reports
≤2.0.7Update to 2.0.8
- Medium6.4Contributor+ Stored Cross-Site Scripting
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player
≤2.1.2Update to 2.1.3
- Medium5.4Stored Cross-Site Scripting
One User Avatar | User Profile Picture
<2.3.7Update to 2.3.7
- Critical9.8Authentication Bypass via Password Reset
YITH Easy Login & Register Popup for WooCommerce
≤1.8.0Update to 1.8.1