CWE-352Vulnerability type

WordPress CSRF vulnerabilities (page 1348)

Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress CSRF vulnerabilities (page 1348)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Cross-Site Scripting bib2html≤0.9.3No patch available	CVE-2014-3870	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Count per Day≤3.1.1Update to 3.2	CVE-2012-3434	—	Aug 1, 2014
Medium5.3	Full Path Disclosure WP PHP widget≤1.0.2No patch available	CVE-2013-0721	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting Redirection<2.2.9Update to 2.2.9	CVE-2011-5329	—	Aug 1, 2014
High7.1	Cross-Site Scripting Polylang<1.5.2Update to 1.5.2	CVE-2014-4855	—	Aug 1, 2014
Critical9.8	Unauthenticated Command Injection EZPZ One Click Backup≤12.03.10No patch available	CVE-2014-3114	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery Stream Video Player≤1.4.1No patch available	CVE-2013-2706	—	Aug 1, 2014
High7.2	Stored Cross-Site Scripting PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links<1.6.3Update to 1.6.3	CVE-2013-1636	—	Aug 1, 2014
Medium6.4	Stored Cross-Site Scripting BuddyPress≤1.9.1Update to 1.9.2	CVE-2014-1888	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting BulletProof Security≤.48.9Update to .49	CVE-2013-3487	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery Disable Comments<1.0.4Update to 1.0.4	CVE-2014-2550	—	Aug 1, 2014
Critical9.8	Arbitrary File Upload MailPoet Newsletters (Previous)≤2.6.6Update to 2.6.7	CVE-2014-4725	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting custom-tables≤3.4.4No patch available	CVE-2012-20003	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting WP App Maker≤1.0.16.4No patch available	CVE-2014-4578	—	Aug 1, 2014
Critical9.8	Remote Code Execution WP Super Cache<1.3.2Update to 1.3.2	CVE-2013-2011	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Tweet Blender≤4.0.1Update to 4.0.2	CVE-2013-6342	—	Aug 1, 2014
Medium6.1	Open Redirection WP Symposium≤13.04Update to 13.05	CVE-2013-2694	—	Aug 1, 2014
Medium6.3	Cross-Site Request Forgery WordPress Content Slide≤1.4.2No patch available	CVE-2013-2708	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery Xhanch – My Twitter≤2.7.6Update to 2.7.7	CVE-2013-3253	—	Aug 1, 2014
High8.8	Remote Code Execution WP Super Cache≤1.2Update to 1.3	CVE-2013-2009	—	Aug 1, 2014
Critical9.9	Authenticated SQL Injection BSK PDF Manager<1.5Update to 1.5	CVE-2014-4944	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Events Manager Pro<2.2.9Update to 2.2.9	CVE-2013-1407	—	Aug 1, 2014
High8.1	Unauthenticated Local File Inclusion Tinymce Thumbnail Gallery≤1.0.0Update to 1.1.0	CVE-2012-20002	—	Aug 1, 2014
Critical9.8	Arbitrary File Upload WordPress Font Uploader≤1.3Update to 1.3.1	CVE-2012-3814	—	Aug 1, 2014
High7.3	Authentication Bypass Portable phpMyAdmin≤1.3.0Update to 1.3.1	CVE-2012-5469	—	Aug 1, 2014
Medium4.3	Cross-Site Request Forgery Calendar≤1.3.2Update to 1.3.3	CVE-2013-2698	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting wp-media-player≤0.8No patch available	CVE-2014-4589	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Adminimize≤1.7.21Update to 1.7.22	CVE-2011-4926	—	Aug 1, 2014
Medium6.5	Cross-Site Request Forgery wp-html-sitemap≤1.2No patch available	CVE-2014-2675	—	Aug 1, 2014
Medium6.1	Reflected Cross Site Scripting WHOIS≤1.4.2.2Update to 1.4.2.3	CVE-2011-5194	—	Aug 1, 2014

Medium6.1
Cross-Site Scripting
bib2html
≤0.9.3No patch available
CVE-2014-3870Aug 1, 2014
Medium6.1
Cross-Site Scripting
Count per Day
≤3.1.1Update to 3.2
CVE-2012-3434Aug 1, 2014
Medium5.3
Full Path Disclosure
WP PHP widget
≤1.0.2No patch available
CVE-2013-0721Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
Redirection
<2.2.9Update to 2.2.9
CVE-2011-5329Aug 1, 2014
High7.1
Cross-Site Scripting
Polylang
<1.5.2Update to 1.5.2
CVE-2014-4855Aug 1, 2014
Critical9.8
Unauthenticated Command Injection
EZPZ One Click Backup
≤12.03.10No patch available
CVE-2014-3114Aug 1, 2014
High8.8
Cross-Site Request Forgery
Stream Video Player
≤1.4.1No patch available
CVE-2013-2706Aug 1, 2014
High7.2
Stored Cross-Site Scripting
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
<1.6.3Update to 1.6.3
CVE-2013-1636Aug 1, 2014
Medium6.4
Stored Cross-Site Scripting
BuddyPress
≤1.9.1Update to 1.9.2
CVE-2014-1888Aug 1, 2014
Medium6.1
Cross-Site Scripting
BulletProof Security
≤.48.9Update to .49
CVE-2013-3487Aug 1, 2014
High8.8
Cross-Site Request Forgery
Disable Comments
<1.0.4Update to 1.0.4
CVE-2014-2550Aug 1, 2014
Critical9.8
Arbitrary File Upload
MailPoet Newsletters (Previous)
≤2.6.6Update to 2.6.7
CVE-2014-4725Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
custom-tables
≤3.4.4No patch available
CVE-2012-20003Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
WP App Maker
≤1.0.16.4No patch available
CVE-2014-4578Aug 1, 2014
Critical9.8
Remote Code Execution
WP Super Cache
<1.3.2Update to 1.3.2
CVE-2013-2011Aug 1, 2014
Medium6.1
Cross-Site Scripting
Tweet Blender
≤4.0.1Update to 4.0.2
CVE-2013-6342Aug 1, 2014
Medium6.1
Open Redirection
WP Symposium
≤13.04Update to 13.05
CVE-2013-2694Aug 1, 2014
Medium6.3
Cross-Site Request Forgery
WordPress Content Slide
≤1.4.2No patch available
CVE-2013-2708Aug 1, 2014
High8.8
Cross-Site Request Forgery
Xhanch – My Twitter
≤2.7.6Update to 2.7.7
CVE-2013-3253Aug 1, 2014
High8.8
Remote Code Execution
WP Super Cache
≤1.2Update to 1.3
CVE-2013-2009Aug 1, 2014
Critical9.9
Authenticated SQL Injection
BSK PDF Manager
<1.5Update to 1.5
CVE-2014-4944Aug 1, 2014
Medium6.1
Cross-Site Scripting
Events Manager Pro
<2.2.9Update to 2.2.9
CVE-2013-1407Aug 1, 2014
High8.1
Unauthenticated Local File Inclusion
Tinymce Thumbnail Gallery
≤1.0.0Update to 1.1.0
CVE-2012-20002Aug 1, 2014
Critical9.8
Arbitrary File Upload
WordPress Font Uploader
≤1.3Update to 1.3.1
CVE-2012-3814Aug 1, 2014
High7.3
Authentication Bypass
Portable phpMyAdmin
≤1.3.0Update to 1.3.1
CVE-2012-5469Aug 1, 2014
Medium4.3
Cross-Site Request Forgery
Calendar
≤1.3.2Update to 1.3.3
CVE-2013-2698Aug 1, 2014
Medium6.1
Cross-Site Scripting
wp-media-player
≤0.8No patch available
CVE-2014-4589Aug 1, 2014
Medium6.1
Cross-Site Scripting
Adminimize
≤1.7.21Update to 1.7.22
CVE-2011-4926Aug 1, 2014
Medium6.5
Cross-Site Request Forgery
wp-html-sitemap
≤1.2No patch available
CVE-2014-2675Aug 1, 2014
Medium6.1
Reflected Cross Site Scripting
WHOIS
≤1.4.2.2Update to 1.4.2.3
CVE-2011-5194Aug 1, 2014