CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 1346)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8SQL Injection
gallery-objects
≤0.4No patch available
- Medium6.3Multiple Cross-Site Request Forgery
Disqus Comment System
<2.79Update to 2.79
- Medium6.11.6.1 - Cross-Site Scripting
Cakifo
1.0 – 1.6.1Update to 1.6.2
- Medium5.3Improper Input Validation
WP-Ban
<1.64Update to 1.64
- High7.1Cross-Site Scripting
Login Widget With Shortcode
<3.2.1Update to 3.2.1
- High7.3Cross-Site Scripting via range Parameter
WooCommerce
<2.2.3Update to 2.2.3
- Critical9.8SQL Injection
WP Support Plus Responsive Ticket System
<4.2Update to 4.2
- Medium5.3Full Path Disclosure
WP Support Plus Responsive Ticket System
<4.2Update to 4.2
- Critical9.8Arbitrary File Download
Epic Church by Organized Themes
≤3.6No patch available
- High7.5Arbitrary File Download
Antioch
≤1.3No patch available
- High8.8Responsive Photo Gallery <= 1.0.7 - SQL Injection
Image Gallery - Responsive Photo Gallery
≤1.0.7Update to 1.0.8
- High8.8Arbitrary File Upload
Slideshow Gallery LITE
<1.4.7Update to 1.4.7
- Medium5.3Security Bypass
Jetpack – AI Agents & MCP, Security, Backup & Analytics
≤2.9.2Update to 1.9.4 or 2.0.9 or 2.1.4 or 2.2.7 or 2.3.7 or 2.4.4 or 2.5.2 or 2.6.3 or 2.7.2 or 2.8.2 or 2.9.3
- Medium6.1Cross-Site Scripting
Memphis Documents Library
<3.0Update to 3.0
- Medium6.1Reflected Cross-Site Scripting
Iptanus File Upload
≤2.4.3Update to 2.4.4
- High7.2Arbitrary File Overwrite
Access Governance for WordPress (aka AAM)
<2.8.3Update to 2.8.3
- High7.5Directory Traversal
WP Source Control
<3.1.1Update to 3.1.1
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Improved user search in backend
≤1.2.5Update to 1.2.6
- Medium5.4Cross-Site Request Forgery
Disqus Comment System
<2.76Update to 2.76
- High8.3SQL Injection
GB Gallery Slideshow
<1.6Update to 1.6
- Medium6.1Cross-Site Scripting
MobiLoud – WordPress Mobile Apps – Convert your WordPress Website to Native Mobile Apps
<2.3.8Update to 2.3.8
- Medium6.3Cross-Site Request Forgery
Iptanus File Upload
<2.4.2Update to 2.4.2
- Medium6.5Unauthenticated Stored Cross-Site Scripting
Job Board by BestWebSoft
≤1.0.0Update to 1.0.1
- Medium6.1Open Redirect
Feed Statistics
<4.0Update to 4.0
- High7.1Reflected Cross-Site Scripting
SI Captcha Anti-spam
<2.7.6Update to 2.7.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
≤3.81Update to 3.82
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
BestWebSoft's Twitter
≤1.3.2Update to 1.3.7
- Low2.7Denial of Service via XML
WordPress
≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
- Low3.8Authenticated Cross-Site Scripting via Avatar URL
WordPress
≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
- Medium6.1Cross-Site Scripting
WordPress Spreadsheet
≤0.62No patch available