CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 1361)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2012-10013 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2012-10014 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2012-10017 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2012-10015 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-6714 | — | |
| Critical9.8 | Directory Traversal | CVE-2012-6652 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2012-20005 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-6713 | — | |
| Medium6.1 | Cross-Site Request Forgery | CVE-2013-2108 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2012-6634 | — | |
| Medium4.3 | Sensitive Information Disclosure | CVE-2012-6635 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2012-3384 | — | |
| Medium4.3 | Information Disclosure | CVE-2012-3385 | — | |
| Medium6.5 | Cross-Site Scripting | CVE-2012-6633 | — | |
| Low3.7 | Informational < 6.8 - Weak Hashing Algorithm | CVE-2012-6707 | — | |
| Critical9.8 | SQL Injection | CVE-2018-12534 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-10020 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-10011 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-6649 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-3575 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-10064 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-3578 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-2633 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-3574 | — | |
| Critical9.8 | Remote File Upload | CVE-2012-10027 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-3577 | — | |
| Critical9.8 | Brute Force Bypass | CVE-2012-10001 | — | |
| High7.5 | Arbitrary File Read | CVE-2012-3588 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2012-6715 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-10026 | — |
- Medium6.1Reflected Cross-Site Scripting
Backend Localization
1.6.1 – 1.6.1Update to 2.0
- Medium6.1Reflected Cross-Site Scripting
Backend Localization
≤2.0Update to 2.0.1
- Medium4.3Cross-Site Request Forgery
Portfolio Plugin
≤2.04Update to 2.05
- Medium4.3Cross-Site Request Forgery
BestWebSoft's Twitter
≤2.14Update to 2.15
- Medium6.1Cross-Site Scripting
Count per Day
<3.2.3Update to 3.2.3
- Critical9.8Directory Traversal
A Page Flip Book
<3.0Update to 3.0
- Medium6.1Reflected Cross-Site Scripting
socialfit
≤1.2.2No patch available
- Medium6.1Cross-Site Scripting
Job Manager
≤0.7.18Update to 0.7.19
- Medium6.1Cross-Site Request Forgery
WP CleanFix
≤3.0.1Update to 3.0.2
- Medium5.3Sensitive Information Disclosure
WordPress
<3.3.3Update to 3.3.3
- Medium4.3Sensitive Information Disclosure
WordPress
<3.3.3Update to 3.3.3
- High8.8Cross-Site Request Forgery
WordPress
≤3.4Update to 3.4.1
- Medium4.3Information Disclosure
WordPress
≤3.4Update to 3.4.1
- Medium6.5Cross-Site Scripting
WordPress
<3.3.3Update to 3.3.3
- Low3.7Informational < 6.8 - Weak Hashing Algorithm
WordPress
<6.8Update to 6.8
- Critical9.8SQL Injection
Quick Chat
<4.00Update to 4.00
- Critical9.8Arbitrary File Upload
FoxyPress
<0.4.2.2Update to 0.4.2.2
- Critical9.8Arbitrary File Upload
HD FLV PLayer
≤1.7Update to 1.8
- Critical9.8Arbitrary File Upload
WP GPX Maps – GPX, FIT & KML maps with elevation profile
<1.1.23Update to 1.1.23
- Critical9.8Arbitrary File Upload
rbxgallery
<3.1Update to 3.1
- Critical9.8Arbitrary File Upload
Omni Secure Files
≤0.1.13Update to 0.1.14
- Critical9.8Arbitrary File Upload
FCChat Widget
<2.2.13.7Update to 2.2.13.7
- Medium6.1Cross-Site Scripting
WassUp Real Time Analytics
<1.8.3.1Update to 1.8.3.1
- Critical9.8Arbitrary File Upload
mm-forms-community
≤2.2.6Update to 2.2.7
- Critical9.8Remote File Upload
WP-Property – WordPress Powered Real Estate and Property Management
≤1.35.0Update to 1.35.1
- Critical9.8Arbitrary File Upload
Nmedia WordPress Member Conversation
<1.4Update to 1.4
- Critical9.8Brute Force Bypass
Limit Login Attempts
≤1.7.0Update to 1.7.1
- High7.5Arbitrary File Read
Plugin: Newsletter
≤1.5No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
FormBuilder
≤0.90Update to 0.91
- Critical9.8Arbitrary File Upload
Asset Manager
≤0.3No patch available