CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 102)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Music Player for WooCommerce
≤1.9.1Update to 1.9.2
- High7.5Authenticated (Subscriber+) PHP Object Injection
WPBot – ChatBot Conversational Forms
≤1.5.0Update to 1.5.1
- Medium4.3Missing Authorization
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More
≤1.12.2Update to 1.12.3
- High7.2Unauthenticated Stored Cross-Site Scripting
JW Player for WordPress
≤2.3.11Update to 2.3.12
- High7.2Unauthenticated Stored Cross-Site Scripting
Geo Mashup
≤1.13.21Update to 1.13.22
- Medium5.3Missing Authorization
WP Express Checkout (Fast Payments via PayPal & Stripe)
≤2.4.9Update to 2.5.0
- Medium6.6Authenticated (Editor+) PHP Object Injection
Responsive Slider Gallery – Responsive Image Photo Slider
≤1.5.5Update to 1.5.6
- High7.5Unauthenticated SQL Injection
Books Gallery – Book Showcase, Library & Affiliate Plugin
≤4.8.3Update to 4.8.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
oik
≤4.15.4Update to 4.16.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Download Manager
≤3.3.70Update to 3.3.71
- Medium5.33.47.14 - Missing Authorization
WP Fusion Lite – Marketing Automation and CRM Integration for WordPress
3.37.14 – 3.47.14Update to 3.48.0
- Medium5.3Unauthenticated Information Exposure
Payments for Hubtel
≤1.0.1Update to 1.0.2
- Medium5.3Missing Authorization
Payments for Hubtel
≤1.0.1Update to 1.0.2
- Medium5.3Unauthenticated Information Exposure
Request a Quote – Quote Forms for Any WordPress Site
≤2.5.6No patch available
- Medium5.3Unauthenticated Insecure Direct Object Reference
Payments for Hubtel
≤1.0.1Update to 1.0.2
- Medium4.3Missing Authorization
WP Fusion Lite – Marketing Automation and CRM Integration for WordPress
≤3.47.0Update to 3.48.0
- Medium4.3Missing Authorization
Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More
<1.4.6Update to 1.4.6
- Medium5.3Coming Soon & Maintenance <= 4.1.19 - Unauthenticated Maintenance Mode Bypass
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
≤4.1.19Update to 4.1.20
- Medium5.3Unauthenticated Payment Bypass
Paytm Payment Gateway
≤2.8.8Update to 2.8.9
- High7.2Unauthenticated Stored Cross-Site Scripting
Paytm Payment Gateway
≤2.8.8Update to 2.8.9
- Critical9.1Unauthenticated Arbitrary File and Directory Deletion
Cache Enabler
≤1.8.16Update to 1.8.17
- Critical9.1Unauthenticated Arbitrary File Deletion
BackupSheep WordPress Backup Plugin
≤1.8No patch available
- Medium5.3Missing Authorization
Hostinger Migrator
≤1.0Update to 1.1.0
- Medium4.31.4.5 - Missing Authorization
Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More
1.2.2.1 – 1.4.5Update to 1.4.7
- High7.5Denial of Service to Unauthenticated Site Availability Exhaustion
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
≤6.3.10Update to 6.3.11
- High7.5Unauthenticated SQL Injection
Pro Like Button
≤1.0Update to 2.0
- High8.8Cross-Site Request Forgery
Featured Image from URL (FIFU)
≤6.0.7Update to 6.0.8
- High8.1Authenticated (Author+) Arbitrary File Deletion
WEBO MCP
≤3.0.18Update to 3.0.22
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Pixfort Core
<4.3.3Update to 4.3.3
- Medium6.1Reflected Cross-Site Scripting
Five Star Restaurant Reviews
≤2.3.13Update to 2.3.14