CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 1333)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Arbitrary File Upload
ZoomSounds - WordPress Wave Audio Player with Playlist
<3.0Update to 3.0
- Medium6.1Cross-Site Scripting
wp-smiley
≤1.4.1No patch available
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
wp-smiley
≤1.4.1No patch available
- Medium6.1Open Redirect
Wow Moodboard Lite
≤1.1.1.1No patch available
- High8.8SQL Injection
Simple Retail Menus
≤4.0.1Update to 4.1
- Critical9.8SQL Injection
WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress
<1.2Update to 1.2
- Medium5.8Open Proxy
Gmedia Photo Gallery
<1.6.5Update to 1.6.5
- High8.8SQL Injection
GigPress
<2.3.9Update to 2.3.9
- High8.8Multiple Cross-Site Request Forgery
WP Fastest Cache – WordPress Cache Plugin
<0.8.3.5Update to 0.8.3.5
- Medium6.5Cross-Site Scripting
WordPress Landing Pages
<1.8.5Update to 1.8.5
- High8.8Authenticated SQL Injection
NewStatPress
≤0.9.8Update to 0.9.9
- Medium5.4Authenticated Cross-Site Scripting
NewStatPress
≤0.9.8Update to 0.9.9
- High8.8Authenticated SQL Injection
WordPress Landing Pages
<1.8.5Update to 1.8.5
- Medium6.1Reflected Cross-Site Scripting
TFO Graphviz
≤1.9Update to 1.10
- High7.2Stored Cross-Site Scripting
Free counter
≤1.1Update to 1.2
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.5.7Update to 5.5.7
- Medium6.1Stored Cross-Site Scripting
Church Admin
<0.810Update to 0.810
- Medium6.1Reflecte Cross-Site Scripting
woo-popup
≤1.2.2Update to 1.3.0
- Medium5.4Cross-Site Scripting
WP Membership
≤1.2.3No patch available
- High8.8Privilege Escalation
WP Membership
≤1.2.3No patch available
- High7.2Authenticated (Admin+) Remote Code Execution
Custom Content Type Manager
≤0.9.8.5Update to 0.9.8.6
- Medium6.1Cross-Site Scripting
Polls CP
<1.0.5Update to 1.0.5
- High7.1Cross-Site Scripting
WP Photo Album Plus
<6.1.3Update to 6.1.3
- Critical9.8SQL Injection
FeedWordPress
<2015.0514Update to 2015.0514
- High7.5Arbitrary File Download via Path Traversal
Simple Backup
<2.7.11Update to 2.7.11
- High8.8Cross-Site Request Forgery
Brute Force Login Protection
≤1.5.1No patch available
- High7.5Sensitive Information Disclosure
Blessing Premium Responsive WordPress Theme
<1.3.2.1Update to 1.3.2.1
- Medium6.5Arbitrary Shortcode Execution
Awesome Support – WordPress HelpDesk & Support Plugin
<3.1.7Update to 3.1.7
- High7.5Sensitive Information Disclosure
Accio | Responsive Onepage Parallax Agency WordPress Theme
≤1.1.0Update to 1.1.1
- High7.5Sensitive Information Disclosure
Almera Responsive Portfolio Site Template
<1.1.8Update to 1.1.8