CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 1345)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8SQL Injection
YourMembers
≤3.0No patch available
- High8.8Command Injection
WP-DBManager
<2.72Update to 2.72
- High7.8OS Command Injection
WP-DBManager
<2.72Update to 2.72
- Medium6.5Arbitrary File Read
WP-DBManager
<2.7.2Update to 2.7.2
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Simple Sticky Footer
≤1.3.2Update to 1.3.3
- Medium6.1Cross-Site Scripting
Contact Form DB
≤2.8.19Update to 2.8.20
- Medium6.1Reflected Cross-Site Scripting
EWWW Image Optimizer
≤2.0.1Update to 2.0.2
- Medium6.1Reflected Cross-Site Scripting
Simple Calendar – Google Calendar, Events, & ICS Feeds
<2.0.4Update to 2.0.4
- Medium6.1Reflected Cross-Site Scripting
Titan Framework
<1.6Update to 1.6
- Critical9.8Unspecified Vulnerability
enfold
<3.0.1Update to 3.0.1
- High8.8SQL Injection
BulletProof Security
<.51.1Update to .51.1
- Critical9.81.5.10 - Arbitrary File Upload
Infusionsoft Gravity Forms Add-on
1.5.3 – 1.5.10Update to 1.5.11
- Medium5.31.3.10 - Multiple Cross-Site scripting
Contact Form 7 Integrations
1.0 – 1.3.10Update to 1.3.11
- Critical9.8SQL Injection
WP eCommerce
<3.8.7.6Update to 3.8.7.6
- High7.2Authenticated (Admin+) SQL Injection
Content Audit
<1.6.1Update to 1.6.1
- Low3.1Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.1.30Update to 1.1.31
- Medium6.1Stored Cross-Site Scripting
Subscribe2 – Form, Email Subscribers & Newsletters
<10.16Update to 10.16
- Medium4.8Cross-Site Scripting
BulletProof Security
<.52.5Update to .52.5
- High7.5Unauthenticated Arbitrary File Read
NativeChurch
≤1.6.1Update to 1.6.2
- Medium6.1Multiple Cross-Site Scripting
DZS Video Gallery
<7.95Update to 7.95
- Medium5.3Directory Traversal
Tom M8te
all versionsNo patch available
- Medium6.1Multiple Cross-Site Scripting
bSuite
≤5 alpha 2Update to 5 alpha 3
- High7.25.0.6 - Cross-Site Scripting
Easy Forms for Mailchimp
3.0 – 5.0.6Update to 5.0.7
- High8.8Arbitrary File Upload
Frontend File Manager Plugin
<3.6Update to 3.6
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
I Recommend This – Love/Like Button for WordPress Posts
≤3.7.2Update to 3.7.3
- High7.4Authenticated Access or Cross-Site Request Forgery leading to SQL Injection via orderby, order Parameters
All-In-One Security (AIOS) – Security and Firewall
<3.8.3Update to 3.8.3
- Critical9.8SQL Injection
I Recommend This – Love/Like Button for WordPress Posts
<3.7.3Update to 3.7.3
- Medium4.3Reflected Cross-Site Scripting
MaxButtons – Create buttons
<1.26.1Update to 1.26.1
- High7.3Authorization Bypass
MailPoet Newsletters (Previous)
≤2.6.7Update to 2.6.8
- Medium6.3Cross-Site Request Forgery
MailPoet Newsletters (Previous)
<2.6.11Update to 2.6.11