CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 1297)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Request Forgery | CVE-2019-1000003 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2018-25436 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2024-51792 | — | |
| Critical9.8 | SQL Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.3.21.1Update to 3.3.21.2 | CVE-2019-15025 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-20462 | — | |
| High8.8 | SQL injection | CVE-2018-20556 | — | |
| Medium5.5 | Authenticated Cross-Site Scripting | CVE-2018-16204 | — | |
| High7.5 | Server-Side Request Forgery | CVE-2018-20463 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-20968 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-20231 | — | |
| Critical9.1 | Remote Code Execution | CVE-2018-20156 | — | |
| Medium5.5 | Cross-Site Scripting | CVE-2018-5668 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting via Comments WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20153 | — | |
| High7.7 | Arbitrary File Deletion WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20147 | — | |
| High8.8 | PHP Object Injection WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20148 | — | |
| Medium6.4 | Stored Cross-Site Scripting via File Uploads WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20149 | — | |
| Medium6.1 | WordPress Core < 5.0.1 Reflected Cross-Site Scripting WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20150 | — | |
| Medium4.3 | Authorization Bypass WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20152 | — | |
| High7.5 | Sensitive Information Disclosure WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20151 | — | |
| Medium6.1 | Import Cross-Site Scripting | CVE-2018-20101 | — | |
| High7.5 | Arbitrary File Read | CVE-2019-15330 | — | |
| Medium5.4 | Author+ Stored Cross-Site Scripting | CVE-2018-20986 | — | |
| Critical9.8 | Local File Inclusion | CVE-2018-20985 | — | |
| High8.8 | Authenticated SQL Injection via Settings Import | CVE-2019-15872 | — | |
| Medium5.3 | User Enumeration | CVE-2018-19487 | — | |
| High8.8 | Unauthenticated Arbitrary Password Reset | CVE-2018-19488 | — | |
| Medium4.7 | Authenticated Open Redirect Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.3.19Update to 3.3.19.1 | CVE-2018-19796 | — | |
| Critical9.8 | Improper Access Control | CVE-2018-21007 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2018-19564 | — | |
| Critical9.8 | PHP Object Injection | CVE-2018-20984 | — |
- Medium6.1Cross-Site Request Forgery
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
<3.3.0Update to 3.3.0
- Critical9.8Arbitrary File Upload
Baggage Freight Shipping Australia
≤0.1.0No patch available
- Critical9.8Arbitrary File Upload
Audio Record
≤1.0No patch available
- Critical9.8SQL Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.3.21.1Update to 3.3.21.2
- Medium6.1Cross-Site Scripting
JSmol2WP
≤1.07No patch available
- High8.8SQL injection
Booking Calendar
≤8.4.3Update to 8.4.4
- Medium5.5Authenticated Cross-Site Scripting
XML Sitemap Generator for Google
≤4.0.9Update to 4.1.0
- High7.5Server-Side Request Forgery
JSmol2WP
≤1.07No patch available
- High8.8Cross-Site Request Forgery
Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export
<1.4.2Update to 1.4.2
- High8.8Cross-Site Request Forgery
Two Factor Authentication
<1.3.13Update to 1.3.13
- Critical9.1Remote Code Execution
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<2.0.7Update to 2.0.7
- Medium5.5Cross-Site Scripting
Read and Understood
<2.2Update to 2.2
- Medium6.4Authenticated Stored Cross-Site Scripting via Comments
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- High7.7Arbitrary File Deletion
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- High8.8PHP Object Injection
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.4Stored Cross-Site Scripting via File Uploads
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.1WordPress Core < 5.0.1 Reflected Cross-Site Scripting
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium4.3Authorization Bypass
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- High7.5Sensitive Information Disclosure
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.1Import Cross-Site Scripting
Import and export users and customers
<1.12.1Update to 1.12.1
- High7.5Arbitrary File Read
WebP Express
<0.14.11Update to 0.14.11
- Medium5.4Author+ Stored Cross-Site Scripting
Advanced Custom Fields (ACF®)
<5.7.8Update to 5.7.8
- Critical9.8Local File Inclusion
WP Payeezy Pay
<2.98Update to 2.98
- High8.8Authenticated SQL Injection via Settings Import
LoginPress | wp-login Custom Login Page Customizer
<1.1.16Update to 1.1.16
- Medium5.3User Enumeration
WP JobHunt
<2.4Update to 2.4
- High8.8Unauthenticated Arbitrary Password Reset
WP JobHunt
<2.4Update to 2.4
- Medium4.7Authenticated Open Redirect
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.3.19Update to 3.3.19.1
- Critical9.8Improper Access Control
User Email Verification for WooCommerce
≤3.1.15Update to 3.2.0
- Medium6.1Stored Cross-Site Scripting
Easy Testimonials
<3.6Update to 3.6
- Critical9.8PHP Object Injection
Patreon WordPress
<1.2.2Update to 1.2.2