VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-352Vulnerability type

WordPress CSRF vulnerabilities (page 116)

Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.

Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress CSRF vulnerabilities (page 116)
SeverityVulnerabilityCVEInstallsPublished
Medium6.1Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter
WP Customer Reviews≤3.7.8Update to 3.8.0
CVE-2026-11608—
Medium6.5Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting
Wow Elements Addons for Elementor≤1.11.2Update to 1.11.3
CVE-2026-1641—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler
PDF Builder for WooCommerce. Create invoices,packing slips and more≤2.0.11Update to 2.0.12
CVE-2026-11899—
High8.8Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter
The Welcomizer≤2.8.1Update to 999.0
CVE-2026-4327—
Medium6.1Reflected Cross-Site Scripting via 'uri' and 'host' Parameters
SSL Zen — SSL Certificate Installer & HTTPS Redirects≤4.7.42Update to 4.7.43
CVE-2026-15463—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightboxtext' Shortcode Attribute
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder≤5.1.1Update to 5.1.2
CVE-2026-15098—
High7.2Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes≤5.7.1Update to 5.7.2
CVE-2026-15664—
Medium5.3Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint
Payment Gateway of Stripe for WooCommerce≤5.0.8Update to 5.0.9
CVE-2026-9832—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode
WP Composer – The Easiest Page Builder≤1.0.5Update to 1.0.7
CVE-2026-2422—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting
OTP Login & Register Woocommerce≤2.7.3Update to 2.7.4
CVE-2026-12402—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function
Search Atlas SEO – OTTO AI SEO Automation for WordPress≤2.6.23Update to 2.6.24
CVE-2026-15946—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via 'metasync_post_types' Parameter
Search Atlas SEO – OTTO AI SEO Automation for WordPress≤2.6.23Update to 2.6.24
CVE-2026-15947—
Medium6.5Authenticated (Author+) SQL Injection via 'order' Parameter
Create≤2.5.3Update to 2.5.4
CVE-2026-13200—
Medium6.5Authenticated (Author+) SQL Injection via 'order_by' Parameter
Create≤2.5.3Update to 2.5.4
CVE-2026-13191—
Medium4.9Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' Parameter
GoPay for WooCommerce≤1.0.34Update to 1.0.35
CVE-2026-75959—
Medium4.3Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation
BlockSpare – Gutenberg Blocks, AI Content Generator & Site Builder for news, magazine, blog and business sites≤4.2.6Update to 5.0.0
CVE-2026-1242—
Medium5.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action
Ibtana – Ecommerce Product Addons≤0.4.7.7Update to 0.4.7.8
CVE-2026-1984—
Medium6.4Authenticated (Subscriber+) Cross-Site Scripting via User Input
Redux Framework≤4.5.13Update to 4.5.14
CVE-2026-5400—
Medium4.7Unauthenticated Open Redirect via 'redirect_to' Parameter
Hide My WP Ghost – Security & Firewall≤7.0.02Update to 7.0.03
CVE-2026-7527—
High8.1Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content≤4.17.2Update to 4.17.3
CVE-2026-85658—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'license_activate_fleximp' and 'license_deactivate_fleximp' AJAX Actions
Flex Import≤3.0Update to 3.1
CVE-2026-9615—
Medium6.1Reflected Cross-Site Scripting via 'data' Dynamic Content Tag
MC4WP: Mailchimp for WordPress≤4.14.0Update to 4.14.1
CVE-2026-87917—
Medium6.5Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action
Easy Appointments≤3.12.27Update to 3.12.28
CVE-2026-9232—
Medium6.5Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter
Custom Field Template≤2.7.8Update to 2.8
CVE-2026-9855—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler
AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker)≤3.15.3Update to 3.15.4
CVE-2026-13770—
Medium5.3Missing Authorization to Unauthenticated Information Exposure
Bread≤2.9.12Update to 2.9.13
CVE-2026-4792—
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
Asset CleanUp: Page Speed Booster≤1.4.0.5Update to 1.4.0.6
CVE-2026-13354—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter
WP2Social Auto Publish≤2.4.12Update to 2.4.13
CVE-2026-12042—
Critical9.1Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content
WP Recipe Maker≤10.8.1Update to 10.8.2
CVE-2026-89274—
Medium6.1Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
Tutor LMS – eLearning and online course solution≤4.0.8Update to 4.0.9
CVE-2026-89081—

Search VulnCrest Radar

Jump to

Are you sure?