CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 124)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated Remote Code Execution
wpShopGermany IT-RECHT KANZLEI
≤2.3Update to 2.4
- Medium4.32.5.3 - Authenticated (Author+) Information Exposure
Comments Import & Export
2.1.11 – 2.5.3Update to 2.5.4
- Medium5.3Missing Authorization
design-scuole-wordpress-theme
1.0 – 2.17.3No patch available
- Medium5.3Unauthenticated Information Exposure
Newsletter
≤9.3.7Update to 9.3.8
- High7.3Unauthenticated Arbitrary Account Takeover
Headless SSO Plugin for WP
≤1.7.0Update to 1.7.1
- Medium5.3Unauthenticated Payment Bypass
Robokassa payment gateway for Woocommerce
≤1.8.8Update to 1.8.9
- Medium6.1Reflected Cross-Site Scripting
Realtyna Organic IDX plugin + WPL Real Estate
≤5.4.1Update to 5.4.2
- Medium5.3Unauthenticated Payment Bypass
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.0.8Update to 3.0.9
- Medium4.7Open Redirect
design-scuole-wordpress-theme
1.0 – 2.17.3No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Dictionary
≤1.0No patch available
- Medium6.43.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
3.2.0 – 3.2.5Update to 3.2.6
- Critical9.8Unauthenticated Privilege Escalation
Choose User Role at Registration for WooCommerce
≤1.3.2Update to 1.3.3
- Medium5.3Unauthenticated Information Exposure
EduAdmin Booking
≤5.4.2Update to 6.0.0
- Medium4.3Missing Authorization
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.5.0Update to 5.6.0
- High7.51.3.1 - Unauthenticated SQL Injection
Yo
1.1 – 1.3.1No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Dewa Kirim – WooCommerce Gojek / Gosend
≤1.0.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.3Update to 4.4.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'position_button' Parameter
Job Postings
≤2.8.1Update to 2.8.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Visitor Traffic Real Time Statistics pro
≤11.21Update to 11.22
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Inventory Manager
≤2.5.4Update to 2.5.5
- High7.5Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium6.5Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.7.7Update to 3.7.8
- Medium5.3Unauthenticated Sensitive Information Exposure in 'id' Parameter
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery
≤1.16.20Update to 1.16.21
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
≤4.15.0Update to 4.16.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter
ShopEngine – All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets
≤4.9.5Update to 4.9.6
- Medium5.3Unauthenticated Authentication Method Downgrade via 'mo_rest_api_test_config' Parameter
JWT Authentication for WP REST APIs
≤4.7.0Update to 4.8.0
- Medium5.3Unauthenticated Information Exposure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.6Update to 4.4.7
- Medium5.3Unauthenticated Information Exposure
Rox Appointment Booking – Event, Calendar & Appointment Scheduling
≤1.2.7Update to 1.2.8
- Medium4.3Missing Authorization
Schema & Structured Data for WP & AMP
≤1.65Update to 1.66