CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 50)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.1Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.4Update to 5.7.5
- Medium6.1Reflected Cross-Site Scripting via 'token_id' Parameter
Hippoo Mobile App for WooCommerce
≤1.12.0Update to 1.12.1
- High7.2Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.2Update to 6.4.0
- Medium4.3Cross-Site Request Forgery
aThemeArt Theme Helper
≤1.0.8No patch available
- Medium5.3Missing Authorization
Passster – Password Protect Pages and Content
≤4.3.18Update to 4.3.19
- Medium4.3Missing Authorization
Advanced Post Manager
≤4.5.6Update to 4.5.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤3.1.0Update to 3.1.1
- Medium5.3Missing Authorization
YITH PayPal Express Checkout for WooCommerce
≤1.61.0Update to 1.62.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Events Calendar
≤6.18.1Update to 6.18.2
- Medium5.3Missing Authorization
Bookit — Booking & Appointment Calendar
≤2.6.0.5Update to 2.6.0.6
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
SmartCrawl SEO checker, analyzer & optimizer
≤3.16.4Update to 3.17.1
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.26Update to 4.1.27
- Medium6.5Authenticated (Contributor+) SQL Injection
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.16.1Update to 8.16.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.16.1Update to 8.16.2
- Medium5.3Unauthenticated Information Exposure
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.16.1Update to 8.16.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System
≤1.4.54Update to 1.4.55
- High7.5Authenticated (Subscriber+) PHP Object Injection
Strong Testimonials
≤3.3.12Update to 3.3.13
- High7.3Unauthenticated Privilege Escalation
OTP Login With Phone Number, OTP Verification
≤1.8.77Update to 1.8.78
- Medium5.3Missing Authorization
Kit (formerly ConvertKit) – Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership
≤3.4.6Update to 3.4.7
- High8.1Unauthenticated PHP Object Injection
WPBot – ChatBot Conversational Forms
≤1.5.1Update to 1.5.2
- High7.5Unauthenticated SQL Injection
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.29Update to 1.0.30
- Medium5.3Unauthenticated Insecure Direct Object Reference
Electronic Signature Add-on for Fluent Forms
≤2.0.5Update to 2.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting
PowerPack Lite for Beaver Builder
≤1.3.1Update to 1.3.2
- High7.3Unauthenticated Privilege Escalation
OttoKit: All-in-One Automation Platform
≤1.1.40Update to 1.1.41
- High7.2Unauthenticated Stored Cross-Site Scripting
Simply Schedule Appointments
≤1.6.12.35Update to 1.6.12.37
- Medium6.1Reflected Cross-Site Scripting
eStore
≤1.6.13Update to 1.6.14
- Medium4.3Missing Authorization
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution
≤5.4.14Update to 6.0.0
- Medium5.3Missing Authorization
Site Reviews
≤8.3.4Update to 8.3.5
- Medium6.5Authenticated (Subscriber+) Arbitrary CSS Injection
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.32Update to 1.8.0
- Medium5.31.2.9 - Unauthenticated Information Exposure
TrueBooker – Appointment Booking and Scheduler System
1.1.9 – 1.2.9Update to 1.3.0