CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 1330)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.5 | Arbitrary File Download | CVE-2015-1000007 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9452 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9450 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9451 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9453 | — | |
| High7.1 | Multiple Cross-Site Scripting | CVE-2015-2973 | — | |
| High7.5 | Arbitrary File Download | CVE-2015-20067 | — | |
| High7.2 | Local File Includion | CVE-2015-10133 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2015-9454 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2015-9455 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2015-9347 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2015-5484 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-5485 | — | |
| High7.5 | Directory Traversal | CVE-2015-1000006 | — | |
| High7.5 | Arbitrary File Download | CVE-2015-1000005 | — | |
| Medium5.3 | Full Path Disclosure | CVE-2015-1000008 | — | |
| Critical9.8 | Blind SQL Injection | CVE-2015-1000003 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-1000004 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2016-1000156 | — | |
| High7.5 | Improper Input Validation | CVE-2015-9348 | — | |
| High7.2 | SQL Injection | CVE-2015-9234 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-1000000 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2015-9233 | — | |
| High7.2 | Directory Traversal | CVE-2015-5482 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-5481 | — | |
| Medium5.3 | Directory Traversal | CVE-2015-5471 | — | |
| High7.5 | Directory Traversal | CVE-2015-5472 | — | |
| Medium6.5 | Arbitrary File Write | CVE-2015-9456 | — | |
| High7.2 | SQL Injection | CVE-2015-9458 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9459 | — |
- High7.5Arbitrary File Download
wptf-image-gallery
≤1.0.3No patch available
- Critical9.8SQL Injection
NEX-Forms – Ultimate Forms Plugin for WordPress
<4.6.1Update to 4.6.1
- Critical9.8SQL Injection
Plugmatter Optin Feature Box
<2.0.14Update to 2.0.14
- Critical9.8SQL Injection
Plugmatter Optin Feature Box
<2.0.14Update to 2.0.14
- Medium6.1Cross-Site Scripting
Broken Link Manager
<0.6.0Update to 0.6.0
- High7.1Multiple Cross-Site Scripting
Welcart e-Commerce
<1.4.18Update to 1.4.18
- High7.5Arbitrary File Download
WP Attachment Export
<0.2.4Update to 0.2.4
- High7.2Local File Includion
Subscribe to Comments
≤2.1.2Update to 2.3
- High8.8Authenticated SQL Injection
Smooth Slider
≤2.6.5Update to 2.7
- High8.8Cross-Site Request Forgery
BuddyPress Activity Plus
≤1.5Update to 1.6.2
- Medium6.4Stored Cross-Site Scripting
Plotly
≤1.0.2Update to 1.0.3
- Medium6.4Stored Cross-Site Scripting
Plotly
<1.0.3Update to 1.0.3
- Medium6.1Cross-Site Scripting
The Events Calendar: Eventbrite Tickets
<3.10.2Update to 3.10.2
- High7.5Directory Traversal
Recent Backups
≤0.7No patch available
- High7.5Arbitrary File Download
candidate-application-form
≤1.3No patch available
- Medium5.3Full Path Disclosure
MP3-jPlayer
<2.5Update to 2.5
- Critical9.8Blind SQL Injection
filedownload
<1.4Update to 1.4
- Medium6.1Cross-Site Scripting
filedownload
≤1.4Update to 2.0
- Critical9.8Arbitrary File Upload
MailCWP
≤1.100No patch available
- High7.5Improper Input Validation
Sell Downloads
<1.0.8Update to 1.0.8
- High7.2SQL Injection
CP Contact Form with PayPal
<1.1.6Update to 1.1.6
- Critical9.8Arbitrary File Upload
MailCWP
≤1.100Update to 1.110
- High8.8Cross-Site Request Forgery
CP Contact Form with PayPal
<1.1.6Update to 1.1.6
- High7.2Directory Traversal
forumAttachments for bbPress
<2.3Update to 2.3
- Medium6.1Reflected Cross-Site Scripting
forumAttachments for bbPress
<2.3Update to 2.3
- Medium5.3Directory Traversal
Swim Team
≤1.44.1077Update to 1.45.1085
- High7.5Directory Traversal
IBS Mappro
≤0.6Update to 1.0
- Medium6.5Arbitrary File Write
Child Theme Creator by Orbisius
<1.2.8Update to 1.2.8
- High7.2SQL Injection
SEO SearchTerms Tagging 2
≤1.535No patch available
- Medium6.1Reflected Cross-Site Scripting
SEO SearchTerms Tagging 2
≤1.535No patch available