CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 104)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
≤2.0.12Update to 2.0.15
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Awesome Support – WordPress HelpDesk & Support Plugin
≤6.3.9Update to 6.4.0
- Medium4.3Missing Authorization
MakeCommerce for WooCommerce
≤4.1.0Update to 4.1.1
- Medium5.3Unauthenticated Information Exposure
WPMobile.App – Android and iOS App Builder
≤11.83Update to 11.84
- Medium4.32.1.3 - Missing Authorization
Media Library Organizer – Folders, File Manager & Media Categories
2.0.4 – 2.1.3Update to 2.1.4
- Medium5.31.4.0 - Unauthenticated Information Exposure
YayReviews – Advanced Customer Reviews for WooCommerce
1.0.4 – 1.4.0Update to 1.4.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Notification for Telegram
≤3.5.2Update to 3.5.3
- Medium4.7Authenticated (Administrator+) Cross-Site WebP File Deletion or Rename
EWWW Image Optimizer
≤8.7.0Update to 8.8.0
- Medium5.3Unauthenticated Arbitrary Gift Card Price Manipulation
WebToffee Gift Cards for WooCommerce
≤1.3.0Update to 1.3.1
- Medium4.3Missing Authorization
Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF
≤2.0.7Update to 2.0.8
- Medium4.3Missing Authorization
All in One Files Upload for WooCommerce
≤2.0.16Update to 2.0.17
- Medium6.56.17.5 - Unauthenticated Arbitrary Shortcode Execution
The Events Calendar
6.12.0 – 6.17.5Update to 6.17.5.1
- High7.34.3.11 - Unauthenticated Privilege Escalation
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
3.5.29 – 4.3.11Update to 4.3.12
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Content Egg – Affiliate Product Importer & Price Comparison
≤6.3.1Update to 11.9.0
- High7.5Authenticated (Contributor+) PHP Object Injection
DesignSetGo
≤2.8.0Update to 2.8.1
- Medium4.3Authenticated (Subscriber+) Information Exposure
Image Optimizer
≤1.7.6Update to 1.7.7
- High7.22.0.7 - Unauthenticated Stored Cross-Site Scripting
Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF
2.0.0 – 2.0.7Update to 2.0.8
- Medium6.41.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Hostinger Reach – AI-Powered Email Marketing for WordPress
1.0.6 – 1.8.2Update to 1.8.3
- High7.22.0.16 - Unauthenticated Stored Cross-Site Scripting via SVG Upload
All in One Files Upload for WooCommerce
2.0.3 – 2.0.16Update to 2.0.17
- Medium6.41.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Audio Player Block – Advanced Block for Embedding Audio Files
1.1.0 – 1.6.2Update to 1.6.3
- Medium6.44.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
EmbedPress
4.4.9 – 4.6.6Update to 4.6.7
- Critical9.8Unauthenticated Arbitrary File Upload
zella-theme
≤2.6.2Update to 2.6.3
- Medium5.34.3.11 - Missing Authorization
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
2.5.8 – 4.3.11Update to 4.3.12
- High7.3Unauthenticated Unauthorized Customer Account Access
FluentCart – Online Store Builder & eCommerce Checkout
≤1.6.4Update to 1.6.5
- Medium5.3Unauthenticated Information Exposure
Course Booking System
≤7.0.8Update to 7.0.9
- Medium6.3Authenticated (Custom Role+) Privilege Escalation
Vitepos – Point of Sale (POS) for WooCommerce
≤3.5.0Update to 3.5.1
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Cost of Goods: Product Cost & Profit Calculator for WooCommerce
≤3.5.2Update to 4.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Verge3D Publishing and E-Commerce
≤4.13.0Update to 4.13.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Content Egg – Affiliate Product Importer & Price Comparison
≤11.8.0Update to 11.9.0
- High7.58.7.7 - Authenticated (Author+) PHP Object Injection
EWWW Image Optimizer
8.6.0 – 8.7.7Update to 8.8.0