CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 1323)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000133 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10999 | — | |
| Critical9.8 | SQL Injection | CVE-2016-11000 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10867 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10868 | — | |
| High8.8 | Sensitive Information Disclosure | CVE-2016-11003 | — | |
| High8.8 | Privilege Escalation | CVE-2016-11002 | — | |
| High8.8 | Privilege Escalation | CVE-2016-11004 | — | |
| High7.2 | Multiple Vulnerabilities | CVE-2016-0796 | — | |
| High7.2 | Reflected Cross-Site Scripting | CVE-2016-11001 | — | |
| Critical9.8 | Missing Authorization | CVE-2016-10935 | — | |
| High8.8 | Privilege Escalation | CVE-2016-10923 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000128 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-1000152 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-1000147 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000150 | — | |
| Medium6.1 | Reflected Cross-Site Scripting via title_az parameter | CVE-2016-1000130 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000136 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000126 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000146 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000127 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000140 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000144 | — | |
| High8.1 | Shortcode SQL Injection | CVE-2016-20068 | — | |
| High8.8 | Missing Authorization | CVE-2016-10922 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10908 | — | |
| Critical9.8 | Blind SQL Injection | CVE-2016-10909 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-11005 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2016-10912 | — | |
| Medium6.5 | Unauthorized Settings Change | CVE-2016-11006 | — |
- Medium6.1Reflected Cross-Site Scripting
Forget About Shortcode Buttons
≤1.1.1Update to 1.1.2
- Medium6.1Reflected Cross-Site Scripting
Goodnews – Responsive WordPress News/Magazine | News / Editorial
≤5.11.1No patch available
- Critical9.8SQL Injection
Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export
≤1.1Update to 1.2
- Medium6.1Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
<4.0.6Update to 4.0.6
- Medium6.1Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
<4.0.5Update to 4.0.5
- High8.8Sensitive Information Disclosure
Bloom Email Opt-In
<1.1.0Update to 1.1.1
- High8.8Privilege Escalation
Divi Extra
≤1.2.3Update to 1.2.4
- High8.8Privilege Escalation
Bloom Email Opt-In
≤1.1.0Update to 1.1.1
- High7.2Multiple Vulnerabilities
mb.miniAudioPlayer – an HTML5 audio player for your mp3 files
≤1.7.6No patch available
- High7.2Reflected Cross-Site Scripting
User Submitted Posts – Enable Users to Submit Posts from the Front End
<20160215Update to 20160215
- Critical9.8Missing Authorization
Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers
<1.8.4Update to 1.8.4
- High8.8Privilege Escalation
Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools
≤1.5.7Update to 1.5.8
- Medium6.1Reflected Cross-Site Scripting
anti-plagiarism
≤3.60No patch available
- Medium6.1Cross-Site Scripting
Easy Contact Form Builder
≤1.0Update to 1.1
- Medium6.1Cross-Site Scripting
Recipes Writer
≤1.0.4No patch available
- Medium6.1Reflected Cross-Site Scripting
Simplified Content
<1.0.1Update to 1.0.1
- Medium6.1Reflected Cross-Site Scripting via title_az parameter
E-Search
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
heat-trackr
<1.01Update to 1.01
- Medium6.1Reflected Cross-Site Scripting
Admin Font Editor
<1.8Update to 1.8
- Medium6.1Reflected Cross-Site Scripting
Pondol Form to Mail
≤1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
ajax-random-post
≤2.00No patch available
- Medium6.1Reflected Cross-Site Scripting
new-year-firework
≤1.1.9No patch available
- Medium6.1Reflected Cross-Site Scripting
PhotoXhibit
≤2.1.8No patch available
- High8.1Shortcode SQL Injection
Booking Calendar Contact Form
≤1.0.23Update to 1.0.24
- High8.8Missing Authorization
Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools
≤1.5.6Update to 1.5.7
- Medium6.1Reflected Cross-Site Scripting
Booking Calendar Contact Form
≤1.0.23Update to 1.0.24
- Critical9.8Blind SQL Injection
Booking Calendar Contact Form
<1.0.24Update to 1.0.24
- Medium6.1Reflected Cross-Site Scripting
Elfsight Instagram Widget – Instagram Gallery
<1.1.2Update to 1.1.2
- Medium6.4Cross-Site Scripting
Universal Analytics
≤1.3.0Update to 1.3.1
- Medium6.5Unauthorized Settings Change
WP-Invoice – Web Invoice and Billing
≤4.1.0Update to 4.1.1