Skip to content
Laskyr
Free scan
Scan my site free

Read-only. Nothing on your site is changed.

Cross-site scripting (XSS) in WordPress plugins

Cross-site scripting lets someone get their own JavaScript to run in the browser of a person viewing your site. Stored XSS saves the script in the database (in a form field, a shortcode setting, a comment), so it runs for everyone who opens that page. Reflected XSS lives in a crafted link and only runs for the person who clicks it.

The danger is what that script can do in a logged-in admin’s browser: create a new administrator account, change settings, or plant a redirect to a spam site. Many of these records need the attacker to have an account first, often just contributor or subscriber level, so sites that let anyone register are more exposed.

What to do: update the plugin to the fixed version. Remove user accounts you do not need, and do not give contributor access to people you do not know. If a page on your site suddenly redirects visitors elsewhere, treat it as a possible break-in.

Worried a plugin bug was used on your site?

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Newest Cross-site scripting (XSS) records

7,139 on record for the plugins we track; the newest 100 are below. Data as of 2026-11-04.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Other types

Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution · Arbitrary file upload · Path traversal and file read · Authentication bypass · File inclusion · Server-side request forgery (SSRF) · Arbitrary file deletion · Open redirect · Denial of service · Content injection

Browse vulnerabilities

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

← Check a plugin · Free hacked-site scan

First hour checklist

If the site was just hacked, read the emergency kit before you delete files. The page is free. Email is optional.

Read the emergency kit