CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 24)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder
W3 Total Cache
≤2.10.7Update to 2.11.0
- Medium5.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.31Update to 1.0.32
- High7.2Unauthenticated Stored Cross-Site Scripting via 'optionals' Parameter
VikRentCar Car Rental Management System
≤1.4.10Update to 1.4.11
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry
W3 Total Cache
≤2.10.7Update to 2.11.0
- Medium6.5Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
≤1.2.78Update to 1.2.79
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Splitting
User Submitted Posts – Enable Users to Submit Posts from the Front End
≤20260916Update to 20261029
- High7.2Unauthenticated Stored Cross-Site Scripting via 'poplink' Parameter
VikRentCar Car Rental Management System
≤1.4.9Update to 1.4.10
- Medium5.3Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter
Welcart e-Commerce
≤2.12.5Update to 2.12.6
- High7.2Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter
Welcart e-Commerce
≤2.12.5Update to 2.12.6
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag
ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
≤3.12.1Update to 3.12.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.4Update to 4.9.5
- Medium5.3Unauthenticated Sensitive Information Exposure in Object Cache Directory
Seraphinite Accelerator
≤2.29.24Update to 2.29.25
- High7.2Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter
Shipping Zones by Drawing for WooCommerce
≤3.3.0Update to 3.3.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decode
Relevanssi – A Better Search
≤4.28.5Update to 4.28.6
- Critical9.1Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters
Popup Builder – Create highly converting, mobile friendly marketing popups.
≤4.4.5Update to 4.4.6
- Critical9.8Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field
PDF Invoice for WooCommerce + Drag and Drop Template Builder
≤7.1.1Update to 7.2.0
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.5Update to 3.15.6
- High7.2Unauthenticated Stored Cross-Site Scripting via '[ppwp]' Shortcode 'desc_below_form' Attribute via Placeholder Marker Collision
PPWP – Password Protect Pages
≤1.9.26Update to 1.9.27
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.5Update to 3.15.6
- High7.2Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.5Update to 3.15.6
- Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.5.4Update to 4.5.5
- High7.2Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization
Meow Lightbox
≤5.6.4Update to 5.6.5
- High7.5Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.4.1Update to 4.5.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)
Meow Gallery
≤5.5.1Update to 5.5.2
- Medium4.7Unauthenticated Stored Cross-Site Scripting via 'Client-IP' Header
Like Button Rating ♥ LikeBtn
≤2.6.64Update to 2.6.65
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'columns' Parameter
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
≤1.2.2Update to 1.2.3
- Medium5.4Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments
FV Flowplayer Video Player
≤7.5.55.7212Update to 7.5.56.7212
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.199Update to 2.8.200
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes
FV Flowplayer Video Player
≤7.5.55.7212Update to 7.5.56.7212
- Medium5.4Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute
FV Flowplayer Video Player
≤7.5.55.7212Update to 7.5.56.7212