CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 108)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Server-Side Request Forgery
Testimonials Widget
≤4.0.4No patch available
- Medium6.44.2.12 - Authenticated (Author+) Stored Cross-Site Scripting
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
4.0.0 – 4.2.12Update to 4.2.13
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Estatik Real Estate Plugin
≤4.3.5Update to 4.3.6
- High7.5Unauthenticated Denial of Service
WP Store Locator
<3.0.0Update to 3.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing
≤1.69.0Update to 1.69.1
- Medium5.3Missing Authorization
Simply Schedule Appointments
≤1.6.12.29Update to 1.6.12.31
- High8.15.3.6 - Unauthenticated Local File Inclusion
WebFacing™ – Email Accounts management for cPanel®
5.3 – 5.3.6Update to 5.4
- Medium5.38.0.4 - Unauthenticated Information Exposure
File Manager
7.2.2 – 8.0.4Update to 8.0.5
- Medium6.4Authenticated (Listing Admin+) Stored Cross-Site Scripting
WP Directory Kit
≤1.5.7Update to 1.5.8
- Medium5.3Missing Authorization
Blocksy Companion
≤2.1.55Update to 2.1.56
- High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine
≤3.8.14.3Update to 3.8.15
- High7.2Unauthenticated Stored Cross-Site Scripting
ThemeREX Addons
<2.45.0Update to 2.45.0
- Medium5.3Unauthenticated User Impersonation
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.9Update to 4.17.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- High7.2Unauthenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.9Update to 4.17.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤6.5.1Update to 6.5.2
- Medium4.3Cross-Site Request Forgery
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP
≤1.8.1Update to 1.8.2
- Medium5.3Missing Authorization
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.2Update to 4.0.3
- High7.5Authenticated (Contributor+) PHP Object Injection
Go Live Update Urls
≤7.0.8Update to 7.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Site Reviews
≤8.3.1Update to 8.3.2
- High7.5Authenticated (Contributor+) PHP Object Injection
GEO Plugin by Squirrly SEO
≤14.2.5Update to 14.2.6
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤14.16.13Update to 14.16.14
- High7.2Unauthenticated Stored Cross-Site Scripting
Parsi Date | بسته فارسی ساز وردپرس و ووکامرس پارسی دیت
≤6.3Update to 6.4
- Medium6.5Authenticated (Subscriber+) SQL Injection
WP Review Slider Pro
≤12.7.11Update to 12.7.12
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Kadence WooCommerce Email Designer
≤1.5.19.1Update to 1.5.19.2
- High7.2Unauthenticated Stored Cross-Site Scripting
LayerSlider
≤8.4.0Update to 8.4.1
- Medium5.3Unauthenticated Payment Bypass
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management
≤4.6.25Update to 4.6.26
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
JetEngine
≤3.8.14.3Update to 3.8.15
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar
≤6.5.0Update to 6.5.2