CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 1246)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery to Remote Code Execution and/or Cross-Site Scripting
Scroll Baner
≤1.0No patch available
- Medium6.5Cross-Site Request Forgery
One User Avatar | User Profile Picture
<2.3.7Update to 2.3.7
- Medium6.4Cross-Site Scripting
Easy Feeds for X/Twitter – keep your site fresh with live social posts
<1.2Update to 1.2
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Customer Support Ticket System & Helpdesk
<5.10.4Update to 5.10.4
- High7.2Admin+ SQL Injection
MainWP Child Reports
≤2.0.7Update to 2.0.8
- Medium6.1Reflected Cross-Site Scripting
GamePress – The Game Database Plugin
≤1.1.0No patch available
- Medium6.4Contributor+ Stored Cross-Site Scripting
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player
≤2.1.2Update to 2.1.3
- Medium5.4Reflected Cross-Site Scripting
eID Easy
≤4.6Update to 4.7
- Medium5.3Sensitive Information Disclosure
BulletProof Security
≤5.1Update to 5.2
- Medium6.9Stored Cross-Site Scripting
YITH Maintenance Mode
≤1.3.7Update to 1.3.8
- Medium6.4Contributor+ Stored Cross-Site Scripting
Compact WP Audio Player
≤1.9.6Update to 1.9.7
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
PlanSo Forms
≤2.6.4No patch available
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Shared Files – File Upload & Download Manager
<1.6.57Update to 1.6.57
- Critical9.9Authenticated Command Injection
WordPress PDF Light Viewer Plugin
≤1.4.11Update to 1.4.12
- Medium6.4Contributor+ Stored Cross-Site Scripting
DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
≤1.7.12Update to 1.7.13
- Medium4.3Setting Change via Cross-Site Request Forgery
Compact WP Audio Player
≤1.9.6Update to 1.9.7
- Medium5.3Sensitive Information Disclosure
Find My Blocks – Locate blocks on your site
<3.4.0Update to 3.4.0
- Medium6.4Stored Cross-Site Scripting
Podcast Subscribe Buttons
<1.4.2Update to 1.4.2
- High7.5Unauthenticated SQL Injection
Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls
<3.4.2Update to 3.4.2
- Critical9.8Arbitrary File Upload
Download from files
≤1.48No patch available
- Medium4.3Missing Authorization
CURCY – Multi Currency for WooCommerce
≤2.1.17Update to 2.1.18
- Medium6.4Authenticated Stored Cross-Site Scripting
Coming soon and Maintenance mode
<3.5.3Update to 3.5.3
- Medium6.5Missing Authorization
CURCY - WooCommerce Multi Currency - Currency Switcher
≤2.1.17Update to 2.1.18
- Medium4.8wpDiscuz <= 7.3.0 - Authenticated Stored Cross-Site Scripting
Comments – wpDiscuz
≤7.3.0Update to 7.3.2
- Medium4.3Cross-Site Request Forgery leading to Arbitrary Domain Deletion
Software License Manager
<4.5.1Update to 4.5.1
- Medium4.8Admin+ Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤7.3.1Update to 7.3.2
- High8.8Authenticated (Contributor+) Code Injection
Gutenberg Block Editor Toolkit – EditorsKit
≤1.31.5Update to 1.31.6
- Medium6.1Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤7.1.13Update to 7.1.14
- Medium4.8Admin+ Stored Cross-Site Scripting
Simple Social Media Share Buttons – Social Sharing for Everyone
≤3.2.3Update to 3.2.4
- Medium6.5Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤13.1.1Update to 13.1.2