CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 48)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Agent+) Insecure Direct Object Reference
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.4Update to 5.7.5
- Medium5.3Unauthenticated Payment Bypass
Simple Shopping Cart
≤5.3.2Update to 5.3.3
- Medium5.31.1.1 - Missing Authorization
Synchrony Financing
1.0.5 – 1.1.1Update to 1.1.2
- Medium6.5Authenticated (Subscriber+) SQL Injection via mec_fes_csv_export
Modern Events Calendar
<7.37.0Update to 7.37.0
- Medium5.3Unauthenticated Payment Forgery
Snap Finance
<3.12.0Update to 3.12.0
- Medium5.30.3.9 - Missing Authorization
Wava Payment Plugin
0.3.1 – 0.3.9Update to 0.3.10
- Medium5.30.3.9 - Missing Authorization
Wava Payment Plugin
0.3.1 – 0.3.9Update to 0.3.10
- Medium4.3Missing Authorization
Sensei LMS – Online Courses, Quizzes, & Learning
≤4.26.3Update to 4.26.4
- Medium6.1Reflected Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.0Update to 4.0.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
Kliken: Ads + Pixel for Meta
≤1.2.2Update to 1.2.3
- Medium6.5Authenticated (Author+) SQL Injection
Swift Performance Lite
≤2.3.7.3Update to 2.3.7.4
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
WPZOOM Portfolio Lite – Filterable Portfolio Plugin
≤1.4.33Update to 1.4.34
- Medium4.3Missing Authorization
Productive Commerce – Wishlist, Compare & MiniCart
≤1.1.48Update to 1.1.49
- Medium6.1Reflected Cross-Site Scripting
WP Booking System – Booking Calendar
≤2.1.0.2Update to 2.1.0.3
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
HireZoot – Job Listings, Career Page & Recruitment Tool
≤4.1.0Update to 4.1.1
- Low2.7Missing Authorization
Uncanny Toolkit for LearnDash
≤3.8.1Update to 3.8.2
- Medium4.3Missing Authorization
Moloni
≤5.0.13Update to 5.0.14
- Medium5.3Unauthenticated Information Exposure
Booking Package
≤1.7.30Update to 1.7.31
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Falang multilanguage for WordPress
≤1.4.5Update to 1.4.6
- Medium5.3Unauthenticated Payment Bypass
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.4Update to 5.7.5
- Medium4.35.3.2 - Authenticated (Contributor+) Payment Bypass
Simple Shopping Cart
5.1.3 – 5.3.2Update to 5.3.3
- Medium5.3Unauthenticated Arbitrary Order Status Manipulation
Payment Gateway for Idram
<2.1.6Update to 2.1.6
- Medium6.5Authenticated (Subscriber+) SQL Injection
Modern Events Calendar
<7.37.0Update to 7.37.0
- Medium4.3Download Manager <= 3.3.71 (free) & 7.5.9 (Pro) Cross-Site Request Forgery
Download Manager
≤7.5.8Update to 3.3.71 or 7.5.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤4.3.4Update to 4.3.5
- Medium4.36.3.0 - Two-Factor Authentication Bypass
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
6.2.9 – 6.3.0Update to 6.3.1
- Critical9.1Unauthenticated Arbitrary File Deletion
weForms – Easy Drag & Drop Contact Form Builder For WordPress
≤1.6.28Update to 1.6.29
- High7.23.2.11 - Unauthenticated Stored Cross-Site Scripting
Redirection for Contact Form 7
2.2.7 – 3.2.11Update to 3.2.12
- High8.8Authenticated (Contributor+) Remote Code Execution
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.32Update to 1.8.0
- Medium6.3Authenticated (Author+) Privilege Escalation
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤6.8.5Update to 6.8.6