CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 1340)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Cross-Site Request Forgery to Site Reset
WordPress Uninstall
≤1.2.1No patch available
- Medium6.1Cross-Site Request Forgery and Stored Cross-Site Scripting
Mobile Domain
≤1.5.2No patch available
- Critical9.8Arbitrary File Upload
Cherry Plugin
<1.2.7Update to 1.2.7
- High8.8Multiple Cross-Site Request Forgery to Stored Cross-Site Scripting
Cross Slide
≤2.0.5No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Redirection Page
≤1.2No patch available
- High8.8Privilege Escalation
WPLMS Learning Management System for WordPress, WordPress LMS
≤1.8.4.1Update to 1.9
- Medium6.1Stored Cross-Site Scripting
FancyBox for WordPress
<3.0.3Update to 3.0.3
- Medium6.1Reflected Cross-Site Scripting
Fastly
≤0.97Update to 0.98
- Critical9.8Arbitrary Shortcode Execution
Feed Them Social – Social Media Feeds, Video, and Photo Galleries
≤1.6.9Update to 1.7.0
- High8.8Authenticated (Admin+) SQL Injection
Most Popular Posts Widget
≤0.8Update to 0.9
- Medium6.1Reflected Cross-Site Scripting
Feed Them Social – Social Media Feeds, Video, and Photo Galleries
≤1.6.9Update to 1.7.0
- High7.2Stored Cross-Site Scripting
Incoming Links
<0.9.10bUpdate to 0.9.10b
- Medium6.1Cross-Site Scripting
Banner Effect Header
<1.2.8Update to 1.2.8
- Medium6.1Cross-Site Scripting
WooCommerce
<2.2.11Update to 2.2.11
- Medium6.1Cross-Site Scripting
PowerPress Podcasting plugin by Blubrry
≤6.0.0Update to 6.0.1
- Medium5.4Authenticated Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.2.11Update to 1.2.11
- Medium6.1Cross-Site Scripting
Geo Mashup
<1.8.3Update to 1.8.3
- Medium5.4Cross-Site Scripting
Google Doc Embedder
<2.5.19Update to 2.5.19
- Medium6.1Cross-Site Request Forgery and Cross-Site Scripting
acobot
≤2.0No patch available
- High7.1Cross-Site Scripting
WDSocialWidgets
<1.0.11Update to 1.0.11
- High8.8Authenticated SQL Injection via asc_or_desc Parameter
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.2.11Update to 1.2.11
- Critical9.8Arbitrary File Upload
Iptanus File Upload
≤2.4.6Update to 2.5.0
- Critical9.8Missing Authorization to Unauthenticated Arbitrary Options Update
Platform
<1.4.4Update to 1.4.4
- High7.5Directory Traversal
Pixabay Images
≤2.3Update to 2.4
- Critical9.8Authentication Bypass to Arbitrary File Upload
Pixabay Images
≤2.0Update to 2.4
- High8.8Arbitrary File Upload
Pixabay Images
≤2.3Update to 2.4
- Medium6.1Cross-Site Scripting
Pixabay Images
<2.4Update to 2.4
- Critical9.8Arbitrary File Upload
Holding Pattern
≤0.6No patch available
- High7.3Missing Authorization
Pie Register – User Registration, Profiles & Content Restriction
≤2.0.13Update to 2.0.14
- High7.5Directory Traversal
GI-Media Library
<3.0Update to 3.0