CWE-98Vulnerability type
WordPress Local File Inclusion vulnerabilities (page 1275)
Template or module loaders that include attacker-chosen files, often leading to code execution.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery Bypass
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
<1.8.3Update to 1.8.3
- Medium4.3Cross-Site Request Forgery Bypass
Feed Them Social – Social Media Feeds, Video, and Photo Galleries
<2.8.7Update to 2.8.7
- Medium4.3Cross-Site Request Forgery Bypass
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
<3.5.8Update to 3.5.8
- Medium4.3Cross-Site Request Forgery Bypass
Import / Export Customizer Settings
<1.0.4Update to 1.0.4
- Medium4.3Cross-Site Request Forgery Bypass
Radio Buttons for Taxonomies
<2.0.6Update to 2.0.6
- Medium4.3Cross-Site Request Forgery Bypass
Custom Field Template
<2.5.2Update to 2.5.2
- Medium4.3Cross-Site Request Forgery Bypass
Easy Testimonials
<3.7Update to 3.7
- Medium4.3Cross-Site Request Forgery Bypass
Coupon Creator
<3.1.1Update to 3.1.1
- High8.8Cross-Site Request Forgery
Coming Soon & Maintenance Mode Page & Under Construction
≤1.57Update to 1.58
- Medium4.3Cross-Site Request Forgery Bypass
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
<3.0.9Update to 3.0.9
- Medium4.3Cross-Site Request Forgery Bypass
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
<2.4.1Update to 2.4.1
- Medium4.3Cross-Site Request Forgery Bypass
Lightweight Sidebar Manager
≤1.1.4Update to 1.1.5
- Medium4.3Cross-Site Request Forgery Bypass
Menu Swapper
≤1.1.0.2Update to 1.1.1
- Critical9.8SQL Injection
DiveBook
≤1.1.4No patch available
- Medium6.1Reflected Cross-Site Scripting
DiveBook
≤1.1.4No patch available
- Medium5.3Sensitive Information Disclosure via Directory Listing
Noo JobMonster
≤4.6.6Update to 4.6.6.1
- Medium5.3Unauthenticated Email Forgery
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
<4.5.6Update to 4.5.6
- Critical9.8SQL Injection
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
≤7.11.17Update to 7.11.18
- Medium4.3Cross-Site Request Forgery Bypass
EWWW Image Optimizer
≤5.8.1Update to 5.9
- Medium4.3Cross-Site Request Forgery
ActiveCampaign – The autonomous marketing platform
<8.0.2Update to 8.0.2
- High7.2SQL injection
Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance
<3.0.2Update to 3.0.2
- Medium5.5Constant Contact Forms <= 1.8.7 Editor+ Stored Cross-Site Scripting
Constant Contact Forms
<1.8.8Update to 1.8.8
- Medium5.0Missing Authorization
NextScripts: Social Networks Auto-Poster
≤4.3.17Update to 4.3.18
- Critical9.8KEVPoCArbitrary File Upload/Remote Code Execution
File Manager
≤6.8Update to 6.9
- Medium5.4Stored Cross-Site Scripting
WP smart CRM & Invoices FREE
≤1.8.7No patch available
- High8.8Authenticated SQL Injection
Recall Products
≤0.8No patch available
- Medium6.1Cross-Site Scripting
Chamber Dashboard Business Directory
<3.3.1Update to 3.3.1
- Medium6.1Reflected Cross-Site Scripting
Subscribe Sidebar plugin by Blubrry
≤1.3.1No patch available
- Medium5.4Cross-Site Scripting
Recall Products
≤0.8No patch available
- High7.2SQL Injection
WordPress Poll
≤36No patch available