CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 1286)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.5 | Denial of Service | CVE-2019-18854 | — | |
| Medium6.5 | Authorization Bypass | CVE-2019-18668 | — | |
| Medium4.3 | Authenticated Settings Change | CVE-2019-16251 | — | |
| Medium5.3 | Missing Authorization to Settings Update | CVE-2020-20627 | — | |
| Medium4.4 | Authenticated (Subscriber+) CSV Injection | CVE-2019-17661 | — | |
| High8.8 | Arbitrary File Upload | CVE-2020-7055 | — | |
| High8.8 | HTML Injection | CVE-2019-25150 | — | |
| Medium5.4 | HTML injection | CVE-2019-25144 | — | |
| Medium6.1 | HTML Injection | CVE-2019-25148 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2022-1170 | — | |
| High7.5 | Authenticated SQL Injection | CVE-2020-20625 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2019-16523 | — | |
| Medium5.5 | Authenticated Stored Cross-Site Scripting | CVE-2019-16522 | — | |
| Medium4.3 | Full Path Disclosure | CVE-2019-19983 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2019-16520 | — | |
| High7.2 | SQL injection | CVE-2019-6012 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-6011 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-16521 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-19306 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17672 | — | |
| Medium5.5 | Type Confusion WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17675 | — | |
| Medium5.4 | Server Side Request Forgery #2 WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17670 | — | |
| Medium5.4 | Server Side Request Forgery WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17669 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9508 | — | |
| High7.3 | Cache Poisoning WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17673 | — | |
| Medium5.3 | Authorization Bypass WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17671 | — | |
| High7.5 | Unauthenticated information disclosure | CVE-2019-17574 | — | |
| Medium5.5 | Authenticated Stored Cross-Site Scripting via Customizer WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17674 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2020-20626 | — | |
| Medium5.4 | Reflected Cross-Site Scripting | CVE-2019-17207 | — |
- Medium6.5Denial of Service
Safe SVG
≤1.9.4Update to 1.9.5
- Medium6.5Authorization Bypass
Currency Switcher for WooCommerce
<2.11.2Update to 2.11.2
- Medium4.3Authenticated Settings Change
YITH WooCommerce Wishlist
≤2.2.13Update to 2.2.14
- Medium5.3Missing Authorization to Settings Update
GiveWP – Donation Plugin and Fundraising Platform
<2.5.10Update to 2.5.10
- Medium4.4Authenticated (Subscriber+) CSV Injection
Admin Columns Pro
≤6.4.9Update to 6.4.10
- High8.8Arbitrary File Upload
Elementor Website Builder – more than just a page builder
<2.7.5Update to 2.7.5
- High8.8HTML Injection
Email Templates Customizer and Designer for WordPress and WooCommerce
≤1.3Update to 1.3.1
- Medium5.4HTML injection
WP Email Template
<2.2.11Update to 2.2.11
- Medium6.1HTML Injection
Email Template Designer – WP HTML Mail
<2.9.1Update to 2.9.1
- Medium6.1Reflected Cross-Site Scripting
Noo JobMonster
<4.5.2.9Update to 4.5.2.9
- High7.5Authenticated SQL Injection
Sliced Invoices – WordPress Invoice Plugin
<3.8.4Update to 3.8.4
- Medium6.4Authenticated Stored Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.9.5Update to 5.9.6
- Medium5.5Authenticated Stored Cross-Site Scripting
EU Cookie Law for GDPR/CCPA
<3.1.3Update to 3.1.3
- Medium4.3Full Path Disclosure
Fast Velocity Minify
≤2.7.6Update to 2.7.7
- Medium6.4Stored Cross-Site Scripting
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
≤3.2.6Update to 3.2.7
- High7.2SQL injection
wpDataTables (Premium)
≤2.0.11Update to 2.0.12
- Medium6.1Cross-Site Scripting
wpDataTables (Premium)
≤2.0.11Update to 2.0.12
- Medium6.1Reflected Cross-Site Scripting
Broken Link Checker
<1.11.9Update to 1.11.9
- Medium6.1Reflected Cross-Site Scripting
Zoho CRM Lead Magnet
<1.6.9.2Update to 1.6.9.2
- Medium6.4Authenticated Stored Cross-Site Scripting
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- Medium5.5Type Confusion
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- Medium5.4Server Side Request Forgery #2
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- Medium5.4Server Side Request Forgery
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads – Commissions
≤3.1.2Update to 3.1.3
- High7.3Cache Poisoning
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- Medium5.3Authorization Bypass
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- High7.5Unauthenticated information disclosure
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
≤1.8.12Update to 1.8.13
- Medium5.5Authenticated Stored Cross-Site Scripting via Customizer
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- Medium5.4Stored Cross-Site Scripting
Lara's Google Analytics (GA4)
<2.0.5Update to 2.0.5
- Medium5.4Reflected Cross-Site Scripting
Broken Link Checker
<1.11.9Update to 1.11.9