CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 106)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated SQL Injection
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
≤5.5.84Update to 5.5.85
- Medium6.3Authenticated (Contributor+) Privilege Escalation
WPeMatico RSS Feed Fetcher
≤2.8.26Update to 2.8.27
- High7.53.7.49 - Authenticated (Contributor+) Local File Inclusion
MasterStudy LMS WordPress Plugin – for Online Courses and Education
3.5.29 – 3.7.49Update to 3.7.50
- Medium4.31.26.7 - Authenticated (Subscriber+) Information Exposure
UpdraftPlus Premium
<2.26.8.26Update to 1.26.8 or 2.26.8.26
- High7.2Unauthenticated Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration
Zero Spam for WordPress
≤5.7.10Update to 5.7.11
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field
wpForo Forum
≤3.1.6Update to 3.1.7
- Medium6.1Reflected Cross-Site Scripting via 'page_title' POST Parameter
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
≤2.0.2Update to 2.0.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter
Premium Packages – Sell Digital Products Securely
≤7.2.1Update to 7.2.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
≤4.9.8Update to 5.0.0
- High7.5Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
≤4.9.8Update to 5.0.0
- Medium5.5Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter
Asset CleanUp: Page Speed Booster
≤1.4.0.5Update to 1.4.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter
Themify Builder
≤7.8.1Update to 7.8.2
- Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter
SSL Zen — SSL Certificate Installer & HTTPS Redirects
≤4.7.42Update to 4.7.43
- Medium6.1Reflected Cross-Site Scripting via 'uri' Parameter
SSL Zen — SSL Certificate Installer & HTTPS Redirects
≤4.7.42Update to 4.7.43
- High8.8Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Return
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
≤260814Update to 260829
- High7.2Unauthenticated Stored Cross-Site Scripting via Repeater Field Value
Repeater Fields for Elementor Forms
≤2.2.7Update to 2.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Avatar Field
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.2Update to 4.0.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.2Update to 4.0.3
- High7.3Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJAX Action to Author Role Assignment
Optima Express IDX
≤8.7.5Update to 8.7.6
- High7.2Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter
Restaurant Menu and Food Ordering
≤2.4.14Update to 2.4.15
- High7.5Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters
Modula Image Gallery – Photo Grid & Video Gallery
≤3.0.1Update to 3.0.2
- High8.1Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter
Modula Image Gallery – Photo Grid & Video Gallery
≤3.0.2Update to 3.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter
Fancy Product Designer
≤6.5.2Update to 6.5.3
- High8.8Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more
≤9.6.1.0Update to 9.6.2.0
- Medium6.1Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.5.3Update to 3.6.5.4
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume
HT Contact Form – Drag & Drop Form Builder for WordPress
≤2.10.1Update to 2.10.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute
Gutenverse – WordPress Blocks, Page Builder & Site Editor
≤4.0.8Update to 4.0.9
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.183Update to 2.8.184
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.181Update to 2.8.182
- High7.2Unauthenticated Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta
Fancy Product Designer
≤6.5.2Update to 6.5.3