CWE-352Vulnerability type
WordPress CSRF vulnerabilities (page 90)
Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
elegro Crypto Payment
≤1.0.1No patch available
- Medium5.3Unauthenticated Payment Bypass
Deema Payment Gateway
≤1.1.2No patch available
- Medium5.3Unauthenticated Payment Bypass
Deema Payment Gateway
≤1.1.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
UpSolution Core
≤8.44No patch available
- Medium5.3Unauthenticated Information Exposure
Slider Pro
≤1.0.0No patch available
- Medium4.3Missing Authorization
SmartyParcel Shipping – DHL Express, GLS, InPost & Nova Post for WooCommerce
≤1.23.2Update to 1.23.3
- Medium4.3Cross-Site Request Forgery
Featured Image from URL (FIFU)
≤6.0.7Update to 6.0.8
- High7.5Unauthenticated SQL Injection
tagDiv Opt-In Builder
≤1.7.6Update to 1.7.7
- High7.5Pay Writer <= 12.0.1 - Unauthenticated SQL Injection
JNews - Pay Writer
≤12.0.1Update to 12.0.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
Taskbuilder – Project Management & Task Management Tool With Kanban Board
≤6.0.5Update to 6.0.6
- Medium5.3Missing Authorization to Unauthenticated Settings Update
워드프레스 결제 심플페이 – 우커머스 결제 플러그인
≤5.5.17Update to 5.5.18
- High7.2Unauthenticated Stored Cross-Site Scripting
VikBooking Hotel Booking Engine & PMS
≤1.8.14Update to 1.8.15
- High7.2Unauthenticated Stored Cross-Site Scripting
JetBlog
≤2.4.10Update to 2.4.10.1
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Pay with Vipps and MobilePay for WooCommerce
≤6.2.0Update to 6.2.1
- Medium4.3Missing Authorization
File Media Renamer
≤1.3No patch available
- Medium4.3Cross-Site Request Forgery
Wallstreet
≤2.8.6No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute
Twenty20 Image Before-After
≤2.0.5Update to 2.0.6
- Critical9.1Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output
Beaver Builder Page Builder – Drag and Drop Website Builder
≤2.11.0.5Update to 2.11.0.6
- Medium4.3Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token'
Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative)
≤3.7.1Update to 3.7.2
- High8.1Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter
Nelio Content – Editorial Calendar & Social Media Auto-Posting
≤4.5.0Update to 4.5.1
- Medium6.1Reflected Cross-Site Scripting via 'thumb_url' Parameter
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.46Update to 1.8.47
- Medium6.1Reflected Cross-Site Scripting via REQUEST_URI
WPFront Notification Bar
≤3.5.1Update to 3.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name
WPC Product Options for WooCommerce
≤4.0.5Update to 4.0.6
- Medium6.1Reflected Cross-Site Scripting via 'rule_data' Parameter
WPC Estimated Delivery Date for WooCommerce
≤4.0.1Update to 4.0.2
- Medium5.4Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment
WPMobile.App – Android and iOS App Builder
≤11.84Update to 11.85
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)
WP Ultimate Review
≤2.4.3Update to 2.4.4
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter
WP Ultimate Review
≤2.4.3Update to 2.4.4
- High7.5Unauthenticated SQL Injection via 'fullRef' Parameter
WP Visitor Statistics (Real Time Traffic)
≤8.7Update to 8.7.1
- High7.2Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message
Mail logging & Catcher
≤2.1.12Update to 2.2.0
- High7.5Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
≤3.0.18Update to 3.0.19