CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 101)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- Medium4.3Missing Authorization
Motors – Car Dealership & Classified Listings Plugin
≤1.4.123Update to 1.4.124
- Medium6.4Authenticated (Listing Manager+) Stored Cross-Site Scripting
Motors – Car Dealership & Classified Listings Plugin
≤1.4.123Update to 1.4.124
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
User Submitted Posts – Enable Users to Submit Posts from the Front End
≤20260810Update to 20260916
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.105Update to 4.11.106
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder
≤2.5.63Update to 2.5.64
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
CF7 Views – Complete Entry Management for Contact Form 7
≤3.2.5Update to 3.2.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Qi Addons For Elementor
≤1.11Update to 1.11.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter
ReactPress
≤3.4.0No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Viable URL Media Uploader
≤1.0.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via User-Agent Header
Post Views Stats Counter
≤1.1.7No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'before_price_text' Parameter
Real Estate Manager – Property Listing and Agent Management
≤7.3Update to 7.4
- High7.5Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design
Product Designer App
≤1.1.3No patch available
- Medium6.5Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter
WP Directory Kit
≤1.5.4Update to 1.5.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block
Smart Slider 3
≤3.5.1.38Update to 3.5.1.39
- High7.5Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters
Motors – Car Dealership & Classified Listings Plugin
≤1.4.109Update to 1.4.110
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
≤3.1.1Update to 3.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title
Bold Page Builder
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter
Bold Page Builder
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute
Bold Page Builder
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute
Bold Page Builder
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter
Bold Page Builder
≤5.7.2Update to 5.7.3
- High7.5Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
Simply Schedule Appointments
≤1.6.12.27Update to 1.6.12.33
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)
Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms
≤1.3.4Update to 1.3.5
- Medium4.3Missing Authorization
AllAble Connector
≤0.13.4Update to 0.13.6
- Medium5.3Unauthenticated Information Exposure
BackupEase – Scheduled Backup, Restore & Site Migration
≤2.2.2Update to 2.2.3
- Medium5.3Unauthenticated Information Exposure
StifLi Backup Tools
≤2.2.7Update to 2.2.8
- Critical9.8Unauthenticated Remote Code Execution
SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP
≤2.1.8Update to 2.2.0
- Medium6.5Authenticated (Contributor+) Path Traversal
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators
≤1.2.19Update to 1.2.20
- Medium4.3Missing Authorization
MCP Content Manager Lite
≤1.1.0Update to 1.2.0