WordPress Core Vulnerabilities
- WordPress < 5.4.2 – Disclosure of Password-Protected Page/Post Comments
- WordPress < 5.4.2 – Misuse of set-screen-option Leading to Privilege Escalation
- WordPress < 5.4.2 – Authenticated XSS via Theme Upload
- WordPress < 5.4.2 – Open Redirection
- WordPress < 5.4.2 – Authenticated XSS via Media Files
- WordPress < 5.4.2 – Authenticated XSS in Block Editor
WordPress Plugin Vulnerabilities
- ACF to REST API < 3.3.0 – Unauthenticated Arbitrary wp_options Disclosure
- Coming Soon Page, Under Construction & Maintenance Mode by SeedProd < 5.1.2 – Authenticated Stored Cross Site Scripting (XSS)
- WooCommerce < 4.2.1 – Potential Cross-Site Scripting (XSS) via SelectWoo
- YITH WooCommerce Ajax Product Filter < 3.11.1 – Authenticated Reflected Cross-Site Scripting (XSS)
- WP-Pro-Quiz <= 0.37 – CSRF Leading to Arbitrary Quiz Deletion
- All in One Support Button < 1.8.8 – Authenticated Stored Cross-Site Scripting
- Testimonial Rotator < 3.0.3 – Authenticated Stored Cross-Site Scripting (XSS)
- Delete All Comments Easily <= 1.3 – CSRF Leading to All Comments Deletion
- KingComposer < 2.9.4 – Multiple Critical Issues
- wpDiscuz < 5.3.6 – Unauthenticated SQL Injection
- Brizy – Page Builder < 1.0.126 – Improper Access Controls on AJAX Calls
- SportsPress < 2.7.2 – Authenticated Stored Cross-Site Scripting
- Elementor Page Builder < 2.9.10 – Authenticated Stored XSS
- JobSearch < 1.5.1 – Unauthenticated Reflected Cross-Site Scripting (XSS)
- AdRotate < 5.8.4 – Authenticated SQL Injection
WordPress Theme Vulnerabilities
- Nexos – Real Estate < 1.8 – Unauthenticated Reflected XSS & SQL Injection
- Travel Booking < 2.8.2 – Unauthenticated Reflected XSS
- CityBook < 2.4.4 – Unauthenticated Reflected XSS
- TownHub < 1.3.0 – Unauthenticated Reflected XSS
- Careerfy < 3.9.0 – Unauthenticated Reflected Cross-Site Scripting (XSS)
- Newspaper < 10.3.4 – Authenticated Reflected Cross-Site Scripting
WPScan 
Leave a comment