CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 8)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Ultimate Store Kit – Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder
≤4.0.1Update to 4.0.2
- Medium5.3Missing Authorization
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
≤3.3.0Update to 3.3.1
- Medium4.3Missing Authorization
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.12.0Update to 2.12.1
- Medium4.3Missing Authorization
Media Library Assistant
≤3.43Update to 3.44
- Medium4.3Cross-Site Request Forgery
Photo Gallery by Supsystic – Image Gallery, Masonry, Albums & Lightbox
≤1.21.6Update to 1.21.7
- Medium4.3Missing Authorization
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤4.3.3Update to 4.3.4
- Medium5.3Missing Authorization
MoreConvert Wishlist for WooCommerce
≤2.0.3Update to 2.0.4
- Medium5.3Missing Authorization
Premium Blocks – Gutenberg Blocks, Patterns & Templates
≤2.3.18Update to 2.3.19
- Medium4.3Missing Authorization
Dynific Addons for Elementor (formerly Anywhere Elementor)
≤1.3.0Update to 1.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MoreConvert Wishlist for WooCommerce
≤2.0.3Update to 2.0.4
- Medium5.3Missing Authorization
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution
≤2.5.0Update to 2.6.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Recipe Maker
≤10.9.1Update to 10.9.2
- Medium4.3Missing Authorization
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.8.3Update to 3.8.4
- Medium6.4Authenticated (Vendor+) Stored Cross-Site Scripting
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.8.3Update to 3.8.4
- Medium4.3Missing Authorization
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤4.0.2Update to 4.0.3
- Medium4.3Cross-Site Request Forgery
Wp Social Login and Register Social Counter
≤3.2.3Update to 3.2.4
- Medium4.3Missing Authorization
VOD Infomaniak
≤1.5.15Update to 1.5.16
- Medium5.3Missing Authorization
WP-Lister Lite for Amazon
≤2.9.2Update to 2.9.2.5
- Medium5.3Unauthenticated Information Exposure
YITH WooCommerce Subscription
≤4.22.0Update to 4.23.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'data[ip]' Parameter
Subscribe2 – Form, Email Subscribers & Newsletters
≤10.47Update to 10.48
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameter
Flipbox – Awesomes Flip Boxes Image Overlay
≤3.1.1Update to 3.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'help_title' Shortcode Attribute
Active Woot Products Tables for WooCommerce. 100% FREE
≤2.1.5Update to 2.1.6
- Medium4.3Cross-Site Request Forgery
Superb Addons: Blocks, Patterns, Pre-built Pages, Sliders, Popups, Free Forms, Animations & More
≤4.2.4Update to 4.2.5
- Medium6.1Reflected Cross-Site Scripting
SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO
≤3.1.4Update to 3.1.5
- Medium4.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.12Update to 4.4.13
- High7.3Unauthenticated Arbitrary Shortcode Execution
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.17.7Update to 4.18.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
JetFormBuilder – Hierarchical Select
≤1.0.10Update to 1.0.11
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.8Update to 3.6.8.1
- High7.2Unauthenticated Stored Cross-Site Scripting
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.8Update to 3.6.8.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.8Update to 3.6.8.1