CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 103)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.41.10.1 - Authenticated (Editor+) Stored Cross-Site Scripting
If-So Dynamic Content – Elementor & All Page Builders Personalization
1.9.9 – 1.10.1Update to 1.10.2
- Medium6.11.10.1 - Reflected Cross-Site Scripting
If-So Dynamic Content – Elementor & All Page Builders Personalization
1.8 – 1.10.1Update to 1.10.2
- High7.5Unauthenticated SQL Injection
Paytm Payment Gateway
≤2.8.8Update to 2.8.9
- Medium4.4Authenticated (Shop Manager+) Stored Cross-Site Scripting
Tabs Responsive – With WooCommerce Product Tabs Extension
≤2.5No patch available
- High7.2HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field
HT Contact Form – Drag & Drop Form Builder for WordPress
≤2.10.2Update to 2.10.3
- High8.8Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter
ConvertPlus
≤3.6.3Update to 3.6.4
- Medium5.3Missing Authorization
WebToffee WP Backup and Migration
≤1.6.0Update to 1.6.1
- Medium4.7Unauthenticated Open Redirect
Safe Redirect Manager
≤2.2.0Update to 2.3.0
- High7.5Authenticated (Author+) PHP Object Injection
Minimum and Maximum Quantity for WooCommerce
≤2.1.2Update to 2.1.3
- Medium5.3Unauthenticated Unauthorized Subscription Activation
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.0.9Update to 3.1.0
- High8.1Unauthenticated PHP Object Injection
Booking Activities
≤1.18.7.1Update to 1.18.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Trusted Shops Easy Integration for WooCommerce
≤2.0.6Update to 2.0.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Classified Listing – AI-Powered Classified ads & Business Directory
≤6.1.3Update to 6.1.5
- High7.5Authenticated (Custom Role+) PHP Object Injection
eCommerce Product Catalog
≤3.6.0Update to 3.6.1
- High7.5Authenticated (Custom Role+) PHP Object Injection
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
≤1.17.9Update to 1.17.10
- Medium5.3Missing Authorization
GravityExport Lite for Gravity Forms
≤2.7.2Update to 2.7.3
- Medium5.31.9.7 - Missing Authorization
InPost PL
1.7.5 – 1.9.7Update to 1.9.8
- Medium6.12.8.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Mobile Menu – The Mobile-Friendly Responsive Menu
2.7.4 – 2.8.8Update to 2.9
- Medium5.32.0.6 - Unauthenticated Access Mode Bypass
WPEPP – All In One WordPress Security, Firewall, Malware Scanner & Login Protection
2.0.0 – 2.0.6Update to 2.0.7
- Medium4.3Missing Authorization
Vayu X
≤1.0.5Update to 1.0.6
- Medium5.3Unauthenticated Information Exposure
Connections Business Directory
≤10.4.67No patch available
- Medium5.33.2.9 - Unauthenticated Information Exposure
New User Approve
3.1.0 – 3.2.9Update to 3.2.10
- Medium5.3Unauthenticated Information Exposure
Solace Extra
≤1.7.1Update to 1.7.2
- Medium4.3Authenticated (Subscriber+) Subscription-Gated Post Creation
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.11Update to 4.3.12
- Medium4.7Cross-Site Scripting to Unauthenticated Arbitrary HTML Content Injection in Admin Log
WP Mail Logging
≤1.16.0Update to 1.17.0
- Medium5.32.0.5 - Unauthenticated Arbitrary Payment Amount Reduction
Easy PayPal & Stripe Buy Now Button
1.8 – 2.0.5Update to 2.0.6
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
Schema & Structured Data for WP & AMP
≤1.66Update to 1.67
- High7.22.0.0 - Unauthenticated Server-Side Request Forgery
Broken Link Notifier
1.3.1 – 2.0.0Update to 2.0.0.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
YITH WooCommerce Tab Manager
≤2.15.0Update to 2.15.1
- High7.5Authenticated (Contributor+) PHP Object Injection
Themify Builder
≤7.8.1Update to 7.8.2