VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-352Vulnerability type

WordPress CSRF vulnerabilities (page 1259)

Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.

Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress CSRF vulnerabilities (page 1259)
SeverityVulnerabilityCVEInstallsPublished
Medium6.4Contributor+ Stored Cross-Site Scripting
YouTube Embed, Playlist and Popup by WpDevArt<2.3.9Update to 2.3.9
CVE-2021-24464—
Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Any Hostname≤1.0.6No patch available
CVE-2021-24481—
Medium6.1Reflected Cross-site Scripting via id Parameter
Awesome Weather Widget≤3.0.2No patch available
CVE-2021-24474—
Medium4.3Authenticated Insecure Direct Object Reference
User Profile Picture – Custom Local Avatars<2.6.0Update to 2.6.0
CVE-2021-24473—
Medium6.1Reflected Cross-Site Scripting
Post Grid≤2.1.7Update to 2.1.8
CVE-2021-24488—
Medium5.5Authenticated Stored Cross-Site Scripting
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content<3.1.8Update to 3.1.8
CVE-2021-24450—
Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
DrawBlog≤0.90No patch available
CVE-2021-24479—
High7.2Reflected Cross-Site Scripting via extension
W3 Total Cache0.5 – 2.1.4Update to 2.1.5
CVE-2021-24452—
Medium6.1Reflected Cross-Site Scripting
event-espresso-core≤4.10.6.pUpdate to 4.10.7.p
CVE-2020-26153—
Critical9.8Unauthenticated Arbitrary File Upload
ZoomSounds - WordPress Wave Audio Player with Playlist≤5.96Update to 6.05
CVE-2021-4449—
Medium6.4Authenticated Cross-Site Scripting
WP Popular Posts<5.3.3Update to 5.3.3
CVE-2021-20746—
Medium5.3Local File Inclusion
WP Image Zoom≤1.46Update to 1.47.1
CVE-2021-24447—
Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
CiviCRM for WordPress≤5.28.0Update to 5.28.1
CVE-2020-36389—
High7.1Cross-Site Scripting
Fudousan Plugin≤5.7.0No patch available
CVE-2021-20749—
Critical9.8Unauthenticated Blind SQL Injection
Poll, Survey, Questionnaire and Voting system<1.5.3Update to 1.5.3
CVE-2021-24442—
Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Glass≤1.3.2No patch available
CVE-2021-24434—
Medium6.1Stored Cross-Site Scripting
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas<6.3.1Update to 6.3.1
CVE-2021-24429—
Medium6.1Reflected Cross-Site Scripting
Prismatic≤2.7Update to 2.8
CVE-2021-24409—
High8.0Authenticated CSV Injection
Sign-up Sheets<1.0.14Update to 1.0.14
CVE-2021-24441—
Medium4.3Cross-Site Request Forgery Bypass
Contact Form 7 Style≤3.2No patch available
CVE-2021-4390—
Medium4.3Cross-Site Request Forgery Bypass
Ultimate Gift Cards for WooCommerce≤2.1.1Update to 2.1.2
CVE-2021-4391—
Medium4.3Cross-Site Request Forgery Bypass
Absolute Reviews≤1.0.8Update to 1.0.9
CVE-2021-4426—
Medium5.4Stored Cross-Site Scripting
Prismatic≤2.7Update to 2.8
CVE-2021-24408—
Medium4.3Cross-Site Request Forgery Bypass
DW Question & Answer≤1.5.8No patch available
CVE-2021-4408—
Medium4.3Cross-Site Request Forgery Bypass
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers≤2.8.28Update to 2.8.29
CVE-2021-4415—
Medium5.4Stored Cross-Site Scripting
Browser Screenshots<1.7.6Update to 1.7.6
CVE-2021-24439—
Medium4.3Cross-Site Request Forgery Bypass
wp-mpdf≤3.5.1Update to 3.5.2
CVE-2021-4416—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
simple sort&search≤0.0.3No patch available
CVE-2021-24433—
Medium4.8Authenticated Stored Cross-Site Scripting
My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu)<2.5.2Update to 2.5.2
CVE-2021-24425—
Medium5.4Admin Columns Free < 4.3.2 and Pro < 5.5.2 Authenticated Stored Cross-Site Scripting
Admin Columns<4.3.2Update to 4.3.2
CVE-2021-24365—

Search VulnCrest Radar

Jump to

Are you sure?