CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 109)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Insecure Direct Object Reference
Sprout Invoices – Client Invoicing & Estimates
≤20.8.17Update to 20.8.18
- High8.8Authenticated (Contributor+) Remote Code Execution
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
≤3.2.0Update to 3.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.85Update to 51.1.86
- Medium6.5Authenticated (Editor+) Arbitrary File Deletion
Template Kit – Import
≤1.0.16Update to 1.0.17
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Import and export users and customers
≤2.5.2Update to 2.5.4
- High7.5Unauthenticated Arbitrary File Read
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.5.0Update to 4.5.1
- High7.5Authenticated (Contributor+) PHP Object Injection
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.33.6Update to 2.34.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)
≤1.10.7Update to 1.10.8
- Medium6.1Reflected Cross-Site Scripting
File Manager
≤8.0.4Update to 8.0.5
- Medium6.52.0.2 - Unauthenticated Arbitrary Shortcode Execution
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
1.5.0.1 – 2.0.2Update to 2.0.2.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Review Slider Pro
≤12.7.11Update to 12.7.12
- Medium4.3Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion
MailerLite – Signup forms (official)
≤1.7.21Update to 1.7.22
- Medium6.5Missing Authorization to Unauthenticated Settings Export and Settings Reset
Custom Thank You Page for WooCommerce
≤1.1.2Update to 1.1.3
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure
Spectra Legacy – Gutenberg Blocks
≤2.20.0Update to 2.20.1
- Medium5.4Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.2.0Update to 6.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
WP Multilang – Translation and Multilingual Plugin
≤2.4.31Update to 2.4.32
- Critical9.8Unauthenticated Local File Inclusion via 'vcv-template' Parameter
Visual Composer Website Builder
≤45.16.0Update to 45.16.1
- High8.8Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route
YOP Poll
≤7.0.10Update to 7.0.11
- High7.5Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter
eesy_ID2WP – Publish InDesign HTML5
≤1.0.3Update to 1.0.4
- Medium4.9Authenticated (Editor+) SQL Injection
W4 Post List
≤3.0.6Update to 3.0.7
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP
≤2.1.7Update to 2.1.8
- Medium5.3Unauthenticated Insecure Direct Object Reference
Team – Team Members Showcase Plugin
≤6.0.0Update to 6.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ditty – Responsive News Tickers, Sliders, and Lists
≤3.1.69Update to 3.1.70
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetTricks
≤2.0.1Update to 2.0.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.7.8Update to 3.7.9
- Medium4.3Cross-Site Request Forgery
PublishPress Capabilities: User Role Access Control, Admin Area Permissions
≤2.50.1Update to 2.51.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
≤7.9.5Update to 7.9.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.105Update to 4.11.106
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤4.0.5Update to 4.0.6