CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 46)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated Local File Inclusion
Academist Core
≤1.4.1No patch available
- Critical9.1Unauthenticated Arbitrary File Deletion
Advanced Custom Fields: Extended
≤0.9.2.7Update to 0.9.2.8
- Medium5.3Missing Authorization
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.5Update to 4.9.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Photo Engine (Media Organizer & Lightroom)
≤6.5.7Update to 6.5.8
- Medium4.32.12.2 - Missing Authorization
MB Custom Post Types & Custom Taxonomies
2.4.0 – 2.12.2Update to 2.12.3
- Medium5.32.12.2 - Missing Authorization
MB Custom Post Types & Custom Taxonomies
2.0.2 – 2.12.2Update to 2.12.3
- High7.2Unauthenticated Stored Cross-Site Scripting
PixelYourSite Pro – Your smart PIXEL (TAG) Manager
<12.6.8Update to 12.6.8
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
WP Ultimate Review
≤2.4.4Update to 2.4.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action
DiviGear Carousel
≤5.2.0Update to 5.2.2
- High7.5Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter
EventON - Subscriber
≤1.4.5No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
WP Mailster
≤1.9.1.0Update to 1.9.2.0
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Mang Board
≤2.4.4Update to 2.4.5
- Medium5.3Missing Authorization
BjornTech Swish for WooCommerce
≤3.7.8Update to 3.7.9
- Medium6.1Reflected Cross-Site Scripting
Geo Mashup
≤1.13.22Update to 1.13.23
- High7.2Unauthenticated Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.5Update to 4.9.6
- Medium4.3Missing Authorization
Surfer – WordPress Plugin
≤1.8.0.744Update to 1.8.1.759
- High7.5Authenticated (Contributor+) Local File Inclusion
WP Mailster
≤1.9.1.0Update to 1.9.2.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤34.0.1Update to 34.0.2
- Medium6.1Reflected Cross-Site Scripting
ThemeHunk Customizer
≤2.8.7Update to 2.8.8
- Medium6.1Reflected Cross-Site Scripting
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.14Update to 7.5.15
- High7.5Unauthenticated SQL Injection
Ajax Search Lite – Live Search & Filter
≤4.14.6Update to 4.14.7
- Medium5.3Missing Authorization
YITH WooCommerce Product Bundles
≤2.29.0Update to 2.30.0
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Event Tickets and Registration
≤5.30.1Update to 5.30.2
- Medium5.3Missing Authorization
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.15Update to 6.2.16
- Medium4.3Missing Authorization
FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses
≤2.11.0Update to 2.12.0
- Medium4.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.10Update to 4.4.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
≤2.9.2.4Update to 2.9.2.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
E2Pdf – Export Pdf Tool for WordPress
≤1.32.57Update to 1.32.58
- Medium5.3Missing Authorization
Travelly – Tour & Travel Booking Manager for WooCommerce
≤2.3.5Update to 2.3.6
- Medium5.3Missing Authorization
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.7Update to 7.3.8