CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 1349)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High8.8 | Cross-Site Request Forgery | CVE-2014-2550 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-5329 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2012-20003 | — | |
| Medium5.3 | Information Disclosure | CVE-2013-4454 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2706 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-3870 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2014-1888 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4855 | — | |
| Medium5.3 | Cross-Site Scripting | CVE-2011-4562 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-3434 | — | |
| Critical9.8 | Unauthenticated Command Injection | CVE-2014-3114 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-3253 | — | |
| Medium6.3 | Cross-Site Request Forgery | CVE-2013-2708 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3487 | — | |
| Medium6.1 | Open Redirection | CVE-2013-2694 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2013-1636 | — | |
| High8.1 | Unauthenticated Local File Inclusion | CVE-2012-20002 | — | |
| Medium6.5 | Cross-Site Request Forgery | CVE-2014-2675 | — | |
| High7.3 | Authentication Bypass | CVE-2012-5469 | — | |
| Medium6.1 | Cross-Site Scripting via Search Parameter | CVE-2013-5988 | — | |
| High8.8 | SQL Injection | CVE-2012-5328 | — | |
| Medium6.1 | Reflected Cross Site Scripting | CVE-2011-5194 | — | |
| High8.8 | Remote Code Execution | CVE-2013-2009 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2013-2698 | — | |
| High7.2 | Cross-Site Scripting | CVE-2014-4664 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-9100 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-9099 | — | |
| Critical9.8 | SQL Injection | CVE-2014-5200 | — | |
| Critical9.8 | SQL Injection | CVE-2014-5189 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2014-9098 | — |
- High8.8Cross-Site Request Forgery
Disable Comments
<1.0.4Update to 1.0.4
- Medium6.1Reflected Cross-Site Scripting
Redirection
<2.2.9Update to 2.2.9
- Medium6.1Reflected Cross-Site Scripting
custom-tables
≤3.4.4No patch available
- Medium5.3Information Disclosure
Portable phpMyAdmin
≤1.4.1No patch available
- High8.8Cross-Site Request Forgery
Stream Video Player
≤1.4.1No patch available
- Medium6.1Cross-Site Scripting
bib2html
≤0.9.3No patch available
- Medium6.4Stored Cross-Site Scripting
BuddyPress
≤1.9.1Update to 1.9.2
- High7.1Cross-Site Scripting
Polylang
<1.5.2Update to 1.5.2
- Medium5.3Cross-Site Scripting
Redirection
<2.2.10Update to 2.2.10
- Medium6.1Cross-Site Scripting
Count per Day
≤3.1.1Update to 3.2
- Critical9.8Unauthenticated Command Injection
EZPZ One Click Backup
≤12.03.10No patch available
- High8.8Cross-Site Request Forgery
Xhanch – My Twitter
≤2.7.6Update to 2.7.7
- Medium6.3Cross-Site Request Forgery
WordPress Content Slide
≤1.4.2No patch available
- Medium6.1Cross-Site Scripting
BulletProof Security
≤.48.9Update to .49
- Medium6.1Open Redirection
WP Symposium
≤13.04Update to 13.05
- High7.2Stored Cross-Site Scripting
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
<1.6.3Update to 1.6.3
- High8.1Unauthenticated Local File Inclusion
Tinymce Thumbnail Gallery
≤1.0.0Update to 1.1.0
- Medium6.5Cross-Site Request Forgery
wp-html-sitemap
≤1.2No patch available
- High7.3Authentication Bypass
Portable phpMyAdmin
≤1.3.0Update to 1.3.1
- Medium6.1Cross-Site Scripting via Search Parameter
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
≤2.0.3Update to 2.0.3.1
- High8.8SQL Injection
Mingle Forum
<1.0.33Update to 1.0.33
- Medium6.1Reflected Cross Site Scripting
WHOIS
≤1.4.2.2Update to 1.4.2.3
- High8.8Remote Code Execution
WP Super Cache
≤1.2Update to 1.3
- Medium4.3Cross-Site Request Forgery
Calendar
≤1.3.2Update to 1.3.3
- High7.2Cross-Site Scripting
Wordfence Security – Firewall, Malware Scan, and Login Security
≤5.1.3Update to 5.1.4
- Medium6.1Reflected Cross-Site Scripting
WhyDoWork AdSense
≤1.2No patch available
- High8.8Cross-Site Request Forgery
WhyDoWork AdSense
≤1.2No patch available
- Critical9.8SQL Injection
fbgorilla
all versionsNo patch available
- Critical9.8SQL Injection
Lead-Octopus-Power
<1.1.1Update to 1.1.1
- Medium5.4Cross-Site Scripting
WORDPRESS VIDEO GALLERY
≤2.5Update to 2.6