CWE-352Vulnerability type

WordPress CSRF vulnerabilities (page 1351)

Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress CSRF vulnerabilities (page 1351)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Reflected Cross-Site Scripting Webcam Microphone Screen Recorder – Media Capture≤1.55.4Update to 1.55.5	CVE-2014-4568	—	Jun 12, 2014
Medium6.1	Reflected Cross-Site Scripting VideoWhisper Video Presentation≤3.25Update to 3.31	CVE-2014-4570	—	Jun 12, 2014
Medium6.1	Cross-Site Scripting wp-football≤1.1No patch available	CVE-2014-4586	—	Jun 12, 2014
Medium6.1	Cross-Site Scripting Appointments Scheduler≤1.5No patch available	CVE-2014-4579	—	Jun 12, 2014
Medium6.1	Reflected Cross-Site Scripting WP-Picasa-Image≤1.0No patch available	CVE-2014-4591	—	Jun 12, 2014
Medium6.1	Cross-Site Scripting WP-FaceThumb≤1.0No patch available	CVE-2014-4585	—	Jun 12, 2014
Medium6.1	Reflected Cross-Site Scripting WP Consultant≤1.0No patch available	CVE-2014-4582	—	Jun 12, 2014
Medium6.1	Cross-Site Scripting WikiPop≤2.0No patch available	CVE-2014-4575	—	Jun 12, 2014
High7.1	Cross-Site Scripting WP Microblogs≤0.4.0No patch available	CVE-2014-4590	—	Jun 12, 2014
Medium6.1	Cross-Site Scripting Member Approval≤131109No patch available	CVE-2014-3850	—	Jun 10, 2014
Medium4.3	Cross-Site Request Forgery leading to player deletion JW Player for Flash & HTML5 Video<2.1.4Update to 2.1.4	CVE-2014-4030	—	Jun 10, 2014
High8.8	Cross-Site Request Forgery Featured Comments<1.2.5Update to 1.2.5	CVE-2014-4163	—	Jun 10, 2014
Medium6.1	Reflected Cross-Site Scripting Disqus Comment System<2.76Update to 2.76	CVE-2014-5345	—	Jun 9, 2014
Critical9.8	SQL Injection Participants Database<1.5.4.9Update to 1.5.4.9	CVE-2014-3961	—	Jun 2, 2014
High7.2	Cross-Site Scripting simple-popup-images≤1.0Update to 1.1	CVE-2014-3921	—	May 30, 2014
High7.5	Path Traversal Cross-RSS≤1.7No patch available	CVE-2014-4941	—	May 29, 2014
Critical9.8	SQL Injection WP Rss Poster≤1.0.0No patch available	CVE-2014-4938	—	May 28, 2014
Medium6.1	Cross-Site Scripting Jigoshop Swipe plugin≤3.1.0No patch available	CVE-2014-4557	—	May 28, 2014
High7.1	Cross-Site Scripting Oleggo LiveStream≤0.2.6No patch available	CVE-2014-4540	—	May 28, 2014
Medium6.1	Reflected Cross-Site Scripting ActiveHelper LiveHelp Live Chat<3.1.5Update to 3.1.5	CVE-2014-4513	—	May 28, 2014
Medium6.1	Cross-Site Scripting Rezgo Online Booking<1.4.3Update to 1.4.3	CVE-2014-4546	—	May 28, 2014
High7.1	Cross-Site Scripting Malware Finder≤1.1No patch available	CVE-2014-4538	—	May 28, 2014
Medium6.1	Cross-Site Scripting your-text-manager≤0.3.0No patch available	CVE-2014-4604	—	May 28, 2014
Medium6.1	Cross-Site Scripting OMFG Mobile Pro≤1.1.26No patch available	CVE-2014-4541	—	May 28, 2014
Medium6.1	Reflected Cross-Site Scripting swipehq-payment-gateway-woocommerce≤2.7.1No patch available	CVE-2014-4558	—	May 28, 2014
Medium6.1	Cross-Site Scripting Validated≤1.0.2Update to 2.0.0	CVE-2014-4564	—	May 28, 2014
Medium6.1	Cross-Site Scripting BIC Media Widget≤1.0No patch available	CVE-2014-4516	—	May 28, 2014
Medium6.1	Reflected Cross-Site Scripting Conversador≤2.61No patch available	CVE-2014-4519	—	May 28, 2014
Medium6.1	Cross-Site Scripting wppm≤1.6.4.bNo patch available	CVE-2014-4593	—	May 28, 2014
Medium6.1	Cross-Site Scripting EnvíaloSimple: Email Marketing y Newsletters≤1.97Update to 1.98	CVE-2014-4527	—	May 28, 2014

Medium6.1
Reflected Cross-Site Scripting
Webcam Microphone Screen Recorder – Media Capture
≤1.55.4Update to 1.55.5
CVE-2014-4568Jun 12, 2014
Medium6.1
Reflected Cross-Site Scripting
VideoWhisper Video Presentation
≤3.25Update to 3.31
CVE-2014-4570Jun 12, 2014
Medium6.1
Cross-Site Scripting
wp-football
≤1.1No patch available
CVE-2014-4586Jun 12, 2014
Medium6.1
Cross-Site Scripting
Appointments Scheduler
≤1.5No patch available
CVE-2014-4579Jun 12, 2014
Medium6.1
Reflected Cross-Site Scripting
WP-Picasa-Image
≤1.0No patch available
CVE-2014-4591Jun 12, 2014
Medium6.1
Cross-Site Scripting
WP-FaceThumb
≤1.0No patch available
CVE-2014-4585Jun 12, 2014
Medium6.1
Reflected Cross-Site Scripting
WP Consultant
≤1.0No patch available
CVE-2014-4582Jun 12, 2014
Medium6.1
Cross-Site Scripting
WikiPop
≤2.0No patch available
CVE-2014-4575Jun 12, 2014
High7.1
Cross-Site Scripting
WP Microblogs
≤0.4.0No patch available
CVE-2014-4590Jun 12, 2014
Medium6.1
Cross-Site Scripting
Member Approval
≤131109No patch available
CVE-2014-3850Jun 10, 2014
Medium4.3
Cross-Site Request Forgery leading to player deletion
JW Player for Flash & HTML5 Video
<2.1.4Update to 2.1.4
CVE-2014-4030Jun 10, 2014
High8.8
Cross-Site Request Forgery
Featured Comments
<1.2.5Update to 1.2.5
CVE-2014-4163Jun 10, 2014
Medium6.1
Reflected Cross-Site Scripting
Disqus Comment System
<2.76Update to 2.76
CVE-2014-5345Jun 9, 2014
Critical9.8
SQL Injection
Participants Database
<1.5.4.9Update to 1.5.4.9
CVE-2014-3961Jun 2, 2014
High7.2
Cross-Site Scripting
simple-popup-images
≤1.0Update to 1.1
CVE-2014-3921May 30, 2014
High7.5
Path Traversal
Cross-RSS
≤1.7No patch available
CVE-2014-4941May 29, 2014
Critical9.8
SQL Injection
WP Rss Poster
≤1.0.0No patch available
CVE-2014-4938May 28, 2014
Medium6.1
Cross-Site Scripting
Jigoshop Swipe plugin
≤3.1.0No patch available
CVE-2014-4557May 28, 2014
High7.1
Cross-Site Scripting
Oleggo LiveStream
≤0.2.6No patch available
CVE-2014-4540May 28, 2014
Medium6.1
Reflected Cross-Site Scripting
ActiveHelper LiveHelp Live Chat
<3.1.5Update to 3.1.5
CVE-2014-4513May 28, 2014
Medium6.1
Cross-Site Scripting
Rezgo Online Booking
<1.4.3Update to 1.4.3
CVE-2014-4546May 28, 2014
High7.1
Cross-Site Scripting
Malware Finder
≤1.1No patch available
CVE-2014-4538May 28, 2014
Medium6.1
Cross-Site Scripting
your-text-manager
≤0.3.0No patch available
CVE-2014-4604May 28, 2014
Medium6.1
Cross-Site Scripting
OMFG Mobile Pro
≤1.1.26No patch available
CVE-2014-4541May 28, 2014
Medium6.1
Reflected Cross-Site Scripting
swipehq-payment-gateway-woocommerce
≤2.7.1No patch available
CVE-2014-4558May 28, 2014
Medium6.1
Cross-Site Scripting
Validated
≤1.0.2Update to 2.0.0
CVE-2014-4564May 28, 2014
Medium6.1
Cross-Site Scripting
BIC Media Widget
≤1.0No patch available
CVE-2014-4516May 28, 2014
Medium6.1
Reflected Cross-Site Scripting
Conversador
≤2.61No patch available
CVE-2014-4519May 28, 2014
Medium6.1
Cross-Site Scripting
wppm
≤1.6.4.bNo patch available
CVE-2014-4593May 28, 2014
Medium6.1
Cross-Site Scripting
EnvíaloSimple: Email Marketing y Newsletters
≤1.97Update to 1.98
CVE-2014-4527May 28, 2014