References https://avd.aliyun.com/detail?id=AVD-2025-23792 https://www.tenablecloud.cn/plugins/nessus/125680 https://www.cnvd.org.cn/flaw/show/CNVD-2025-27243 https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/WordPress/WordPress%20Beam%20me%20up%20Scotty%20Plugin%E5%AD%98%E5%9C%A8xss%E6%BC%8F%E6%B4%9E(CVE-2025-31864).md https://www.knowsafe.com/ti/info/0/992511 https://vulners.com/cnnvd/CNNVD-202504-872 https://www.hws.com/help/tech/1900.html https://cve.imfht.com/detail/CVE-2025-22718 https://vulnerability.circl.lu/vuln/cnvd-2021-37473 https://wpservices.com/zh-cn/%E6%95%99%E7%A8%8B/%E4%BF%9D%E6%8A%A4%E4%BD%A0%E7%9A%84%E9%A1%B5%E9%9D%A2%EF%BC%8C%E5%A6%82%E4%BD%95%E5%9C%A8-wordpress-%E4%B8%AD%E9%98%B2%E8%8C%83%E8%B7%A8%E7%AB%99%E8%84%9A%E6%9C%AC-xss/ https://developer.baidu.com/article/details/3100546 https://jetpack.com/resources/wordpress-cross-site-scripting-xss/ https://wordpress.com/plugins/prevent-xss-vulnerability https://www.isitwp.com/fix-prevent-xss-attacks-wordpress/ https://wpscan.com/plugins/ https://www.fastly.com/blog/active-exploitation-unauthenticated-stored-xss-vulnerabilities-wordpress https://patchstack.com/academy/wordpress/vulnerabilities/cross-site-scripting/ https://wordpress.org/plugins/prevent-xss-vulnerability/ https://www.wordfence.com/blog/2024/09/how-to-find-xss-cross-site-scripting-vulnerabilities-in-wordpress-plugins-and-themes/ https://solidwp.com/blog/cross-site-scripting-wordpress/
Related VulnerabilitiesPoCCVE-2026-41948: Dify <=1.14.1 - Unauthenticated Plugin Daemon Path TraversalJeecgBoot 积木报表 /jmreport/auto/export/python/plugin 代码执行漏洞Wordpress Events Calendar插件敏感信息泄露漏洞(CVE-2025-9808)WordPress Directory Kit 插件敏感信息泄露漏洞(CVE-2025-13920)PoCCVE-2025-14998: Branda WordPress plugin - Privilege EscalationPoCCVE-2022-1281: Photo Gallery WordPress v1.6.3 - SQL InjectionPoCCVE-2026-12394: WordPress MemberGlut < 1.1.5 - Unauthenticated Privilege EscalationPoCCVE-2026-55224: MineAdmin < 3.2.0-alpha.2 - Plugin Path Traversal to RCEPoCCVE-2019-1003030: Jenkins Pipeline Groovy Plugin <=2.63 - Insecure DeserializationPoCsimple-file-list-rce: WordPress Simple File List <=4.2.2 - Remote Code ExecutionPoCCVE-2026-13147: WordPress Kirki < 6.0.12 - Server-Side Request ForgeryPoCCVE-2026-14894: WordPress Super Forms <= 6.3.313 - Arbitrary File UploadPoCCVE-2026-17505: WordPress TranslatePress < 3.2.6 - Cross-Site Scripting