CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 1370)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | Arbitrary File Upload | CVE-2008-0222 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2008-0198 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2008-0204 | — | |
| Critical9.8 | 2.3.1 - Authorization Bypass | CVE-2007-6013 | — | |
| Medium5.3 | Full Path Disclosure | CVE-2008-0191 | — | |
| High7.5 | Directory Traversal | CVE-2007-6369 | — | |
| High7.2 | Cross-Site Scripting | CVE-2008-0203 | — | |
| High7.1 | Cross-Site Scripting | CVE-2008-0206 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2008-0205 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2007-6677 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2007-5800 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2007-5710 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2007-5229 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2007-5106 | — | |
| Critical9.8 | SQL Injection | CVE-2007-6318 | — | |
| Medium5.3 | Restriction Bypass | CVE-2008-2146 | — | |
| Medium6.5 | Improper Authorization Checks | CVE-2008-0664 | — | |
| Critical9.8 | SQL Injection | CVE-2007-4894 | — | |
| High8.8 | Remote Code Execution | CVE-2008-5695 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2007-4544 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2007-4481 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2007-4480 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2007-4482 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2007-4483 | — | |
| Medium6.1 | Open Redirect | CVE-2007-3639 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2007-4165 | — | |
| High8.8 | Arbitrary File Upload | CVE-2007-3543 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2007-4893 | — | |
| High8.8 | SQL Injection | CVE-2007-4154 | — | |
| High8.8 | Arbitrary File Upload | CVE-2007-3544 | — |
- Critical9.8Arbitrary File Upload
wp-FileManager
≤1.2Update to 1.3
- High8.8Cross-Site Request Forgery
WP-ContactForm
≤1.5.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Math Comment Spam Protection
≤2.1Update to 2.2
- Critical9.82.3.1 - Authorization Bypass
WordPress
1.5 – 2.3.1Update to 2.3.2
- Medium5.3Full Path Disclosure
WordPress
≤2.4Update to 2.5
- High7.5Directory Traversal
PictPress
≤0.91Update to 0.99
- High7.2Cross-Site Scripting
Cryptographp
≤1.2No patch available
- High7.1Cross-Site Scripting
Captcha!
≤2.5dUpdate to 2.6
- High8.8Cross-Site Request Forgery
Math Comment Spam Protection
≤2.1Update to 2.2
- Medium6.1Cross-Site Scripting
Peter's Random Anti-Spam Image
≤1.0.6No patch available
- Critical9.8Remote File Inclusion
BackUpWordPress
<0.4.3Update to 0.4.3
- Medium6.4Cross-Site Scripting
WordPress
≤2.3Update to 2.3.1
- High8.8Cross-Site Request Forgery
feedburner-feedsmith
≤2.2Update to 2.3
- Medium6.4Cross-Site Scripting
WordPress
≤2.0.3Update to 2.0.4
- Critical9.8SQL Injection
WordPress
≤2.3.1Update to 2.3.2
- Medium5.3Restriction Bypass
WordPress
≤2.2.2Update to 2.2.3
- Medium6.5Improper Authorization Checks
WordPress
≤2.3.2Update to 2.3.3
- Critical9.8SQL Injection
WordPress
<2.2.3Update to 2.2.3
- High8.8Remote Code Execution
WordPress
≤2.3.2Update to 2.3.3
- Medium6.1Cross-Site Scripting
WordPress MU
≤1.0Update to 1.1.1
- Medium6.1Cross-Site Scripting
Blix
≤0.9.1No patch available
- Medium6.1Cross-Site Scripting
Sirius
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Pool
≤1.0.7Update to 1.1
- Medium6.1Cross-Site Scripting
Classic
≤1.5Update to 1.6
- Medium6.1Open Redirect
WordPress
≤2.2.1Update to 2.2.2
- Medium6.1Cross-Site Scripting
Blue Memories
≤1.5Update to 1.5.0.1
- High8.8Arbitrary File Upload
WordPress
≤2.2Update to 2.2.1
- Medium6.4Cross-Site Scripting
WordPress
≤2.2.2Update to 2.2.3
- High8.8SQL Injection
WordPress
≤2.2.1Update to 2.0.11 or 2.2.2
- High8.8Arbitrary File Upload
WordPress
≤2.2.1Update to 2.2.2