CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 105)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated Arbitrary File Upload via Signature Form Field
Ultra Addons for Contact Form 7
≤3.5.50Update to 3.5.51
- Critical9.8Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter
miniOrange OTP Login, Verification and SMS Notifications
≤5.5.5Update to 5.5.6
- High8.8Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcode
Groups – Memberships and Access Control
≤4.6.0Update to 4.7.0
- Critical9.8Unauthenticated Arbitrary File Upload via AJAX Popup Handler
Request a Quote for WooCommerce
≤2.9.2No patch available
- Medium6.4Unauthenticated Stored Cross-Site Scripting via REQUEST_URI
Automatic.css
4.0.0 – 4.0.0Update to 4.0.1
- High8.84.3.1 - Cross-Site Request Forgery via REST Nonce Bypass to Privilege Escalation
Elementor Website Builder – more than just a page builder
4.3.0 – 4.3.1Update to 4.3.2
- Medium6.48.7.5 - Authenticated (Author+) Stored Cross-Site Scripting
Optima Express IDX
8.6.0 – 8.7.5Update to 8.7.6
- Medium5.3Missing Authorization
WP Verify API
≤1.0.0No patch available
- Medium4.3Authenticated (Staff+) Insecure Direct Object Reference
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium5.3Unauthenticated Insecure Direct Object Reference
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PowerPress Podcasting plugin by Blubrry
≤11.17.1Update to 11.17.2
- Medium4.3Missing Authorization
NextScripts: Social Networks Auto-Poster
≤4.4.7Update to 4.4.8
- Medium5.38.7.5 - Missing Authorization
Optima Express IDX
8.5.0 – 8.7.5Update to 8.7.6
- Medium6.5Missing Authorization
Malcure Malware Shield — Removal, Repair, Monitor
≤19.9.6Update to 19.9.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP YouTube Lyte
≤1.7.30Update to 1.7.31
- High7.5Unauthenticated SQL Injection
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤8.0.2Update to 8.0.3
- High7.5Unauthenticated SQL Injection
SPS-Suite
≤1.4.0No patch available
- Medium5.34.13.0 - Missing Authorization
Verge3D Publishing and E-Commerce
4.1.0 – 4.13.0Update to 4.13.1
- Medium5.3Unauthenticated Information Exposure
Verge3D Publishing and E-Commerce
≤4.13.0Update to 4.13.1
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
WPeMatico RSS Feed Fetcher
≤2.8.26Update to 2.8.27
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
WPeMatico RSS Feed Fetcher
≤2.8.26Update to 2.8.27
- Medium4.32.3.1 - Blocked User Restriction Bypass
Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification
1.3.0 – 2.3.1Update to 2.3.2
- Medium5.3Unauthenticated Payment Bypass
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Download Manager
≤7.5.5Update to 7.5.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
EmbedPress
≤4.6.6Update to 4.6.7
- Medium6.42.8.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
2.8.12 – 2.8.18Update to 2.8.19
- Medium5.3Unauthenticated Insecure Direct Object Reference
Mailchimp for WooCommerce
≤6.2Update to 6.3
- Medium6.5Authenticated (Subscriber+) SQL Injection
Post Voting System
≤1.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPeMatico RSS Feed Fetcher
≤2.8.26Update to 2.8.27
- High7.528.2 - Authenticated (Bookly Administrator+) PHP Object Injection
Online Scheduling and Appointment Booking System – Bookly
23.2 – 28.2Update to 28.3