CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 9)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
The Events Calendar
≤6.18.3Update to 6.18.3.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Active Woot Products Tables for WooCommerce. 100% FREE
≤2.1.6Update to 2.1.7
- Medium6.1Reflected Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.14Update to 7.3.15
- Medium5.3Missing Authorization
CURCY – Multi Currency for WooCommerce
≤2.2.20Update to 2.2.21
- Medium4.3Missing Authorization
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution
≤2.5.0Update to 2.6.0
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Cool FormKit Lite – Advanced Form Builder for Elementor
≤2.7.10Update to 2.7.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Post Fields for Contact Form 7
≤2.6.0Update to 2.7.1
- Medium5.3Missing Authorization
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
≤2.6.1Update to 2.6.2
- Medium4.3Missing Authorization
PowerPress Podcasting plugin by Blubrry
≤11.18.0Update to 11.18.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN
≤3.21.2Update to 4.0.0
- Medium4.3Cross-Site Request Forgery
PowerPress Podcasting plugin by Blubrry
≤11.18.0Update to 11.18.2
- Medium4.3Authenticated (Subscriber+) Brute-Force Lockout Bypass
WPBruiser Security – No CAPTCHA Anti-Spam & Login Protection
≤3.6.2Update to 3.6.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.26Update to 2.0.28
- High7.2Unauthenticated Stored Cross-Site Scripting
Invoice Gateway for WooCommerce – Invoice Payment Gateway
≤1.1.6Update to 1.1.7
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
≤3.3.0Update to 3.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤4.3.5Update to 4.3.6
- Medium4.3Missing Authorization
Meta Box – A Framework for Dynamic Websites
≤5.15.3Update to 5.15.4
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.3.1Update to 5.3.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
≤3.3.6Update to 3.3.7
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Welcart e-Commerce
≤2.12.6Update to 2.12.7
- Medium5.3Unauthenticated CAPTCHA Protection Bypass on Login
Simple CAPTCHA with Cloudflare Turnstile
≤1.44.4Update to 1.44.5
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Media Library Assistant
≤3.43Update to 3.44
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Site Reviews
≤8.3.6Update to 8.3.7
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
Ditty – Responsive News Tickers, Sliders, and Lists
≤3.1.71Update to 3.1.72
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Customize WordPress Emails and Alerts – Better Notifications for WP
≤1.10.1Update to 1.10.2
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Exeuction
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.56Update to 3.7.57
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.17.7Update to 4.18.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name]
Download Manager
6.0.0 – 7.5.9Update to 7.6.4
- Critical9.1Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action
Checkout Field Editor for WooCommerce (Pro)
≤3.8.0Update to 3.8.1
- High7.2Unauthenticated Stored Cross-Site Scripting via User-Agent Header
Quttera ThreatSign – Web Malware Scanner for WordPress
≤4.1.0.48Update to 4.1.0.49