Full index
All CVEs by Kevin Mosbahi (Mika)
The complete, searchable list of 700+ CVEs credited to Kevin Mosbahi (Mika) — filterable by severity, each linking to its authoritative Wordfence advisory.
Every entry below is a real, credited CVE from my Wordfence researcher profile — 26 Critical, 75 High and hundreds more. Filter by severity or search for a plugin or CVE ID. Each row links to the authoritative advisory.
700 vulnerabilities
| Severity | Vulnerability | Affected | |||
|---|---|---|---|---|---|
| Critical | 9.8 | CVE-2024-56066 | Agency ToolkitUnauthenticated Privilege Escalation | ≤ 1.0.23 | |
| Critical | 9.8 | CVE-2024-54229 | SV100 CompanionUnauthenticated Privilege Escalation | ≤ 2.0.02 | |
| Critical | 9.8 | CVE-2024-52416 | Debug ToolUnauthenticated Remote Code Execution | ≤ 2.2 | |
| Critical | 9.8 | CVE-2025-31612 | CBX PollUnauthenticated PHP Object Injection | ≤ 1.2.7 | |
| Critical | 9.8 | CVE-2024-56205 | AI MagicUnauthenticated Privilege Escalation | ≤ 1.0.4 | |
| Critical | 9.8 | CVE-2024-56071 | Simple DashboardUnauthenticated Privilege Escalation | ≤ 2.0 | |
| Critical | 9.8 | CVE-2024-54367 | ForumWPUnauthenticated PHP Object Injection | ≤ 2.1.0 | |
| Critical | 9.8 | CVE-2024-54239 | Eyewear prescription formMissing Authorization to Unauthenticated Arbitrary Options Update | ≤ 4.0.18 | |
| Critical | 9.8 | CVE-2024-52447 | Contact Page With Google MapUnauthenticated Arbitrary File Deletion | ≤ 1.6.1 | |
| Critical | 9.8 | CVE-2024-52439 | Team RostersUnauthenticated PHP Object Injection | ≤ 4.8.2 | |
| Critical | 9.8 | CVE-2024-52433 | My Geo Posts FreeUnauthenticated PHP Object Injection | ≤ 1.2 | |
| Critical | 9.8 | CVE-2024-52413 | Airin BlogUnauthenticated PHP Object Injection | ≤ 1.6.2 | |
| Critical | 9.8 | CVE-2024-52412 | XinUnauthenticated PHP Object Injection | ≤ 1.0.8.1 | |
| Critical | 9.8 | CVE-2024-50490 | PegaPollUnauthenticated Arbitrary Options Update | ≤ 1.0.2 | |
| Critical | 9.8 | CVE-2024-50492 | ScottCartUnauthenticated Remote Code Execution | ≤ 1.1 | |
| Critical | 9.8 | CVE-2024-50475 | Signup PageUnauthenticated Arbitrary Options Update | ≤ 1.0 | |
| Critical | 9.8 | CVE-2024-50476 | GRÜN spendino SpendenformularUnauthenticated Arbitrary Options Update | ≤ 1.0.1 | |
| Critical | 9.8 | CVE-2024-49624 | Advanced Advertising SystemUnauthenticated PHP Object Injection | ≤ 1.3.1 | |
| Critical | 9.8 | CVE-2024-49626 | Shipyaari Shipping ManagementUnauthenticated PHP Object Injection | ≤ 1.2 | |
| Critical | 9.8 | CVE-2024-49625 | SiteBuilder Dynamic ComponentsUnauthenticated PHP Object Injection | ≤ 1.0 | |
| Critical | 9.8 | CVE-2024-49332 | Giveaway BoostUnauthenticated PHP Object Injection | ≤ 2.1.4 | |
| Critical | 9.8 | CVE-2023-32590 | Subscribe to CategoryUnauthenticated SQL Injection | ≤ 2.7.4 | |
| Critical | 9.8 | CVE-2023-34027 | Recently Viewed ProductsUnauthenticated PHP Object Injection | ≤ 1.0.0 | |
| Critical | 9.8 | CVE-2022-45355 | WP PipesAuthenticated (Admin+) SQL Injection | ≤ 1.33 | |
| Critical | 9.6 | CVE-2025-23532 | MyAnime WidgetCross-Site Request Forgery to Privilege Escalation | ≤ 1.0 | |
| Critical | 9.1 | CVE-2024-24850 | Quicksand Post Filter jQuery PluginMissing Authorization via quicksand_admin_ajax | ≤ 3.1.1 | |
| High | 8.8 | CVE-2025-27012 | A1POST.BG Shipping for WooCommerceCross-Site Request Forgery to Privilege Escalation | ≤ 1.5 | |
| High | 8.8 | CVE-2025-24661 | Taxi Booking Manager for WooCommerce – WordPress plugin | EcabAuthenticated (Contributor+) PHP Object Injection | ≤ 1.1.8 | |
| High | 8.8 | CVE-2025-23530 | Custom Post Type LockdownCross-Site Request Forgery to Privilege Escalation | ≤ 1.11 | |
| High | 8.8 | CVE-2025-23797 | WP Options EditorCross-Site Request Forgery to Privilege Escalation | ≤ 1.1 | |
| High | 8.8 | CVE-2025-23528 | DD RolesAuthenticated (Subscriber+) Privilege Escalation | ≤ 4.1 | |
| High | 8.8 | CVE-2025-22782 | WR Price List Manager For WoocommerceAuthenticated (Subscriber+) Arbitrary File Upload | ≤ 1.0.8 | |
| High | 8.8 | CVE-2024-49644 | Accessibility by AllAccessibleAuthenticated (Subscriber+) Privilege Escalation | ≤ 1.3.4 | |
| High | 8.8 | CVE-2024-56204 | Sinking DropdownsCross-Site Request Forgery | ≤ 1.25 | |
| High | 8.8 | CVE-2024-56203 | Wayne Audio PlayerCross-Site Request Forgery to Privilege Escalation | ≤ 1.0 | |
| High | 8.8 | CVE-2024-56012 | Flash News / Post (Responsive)Cross-Site Request Forgery to Privilege Escalation | ≤ 4.1 | |
| High | 8.8 | CVE-2024-55986 | ServiceAuthenticated (Subscriber+) SQL Injection | ≤ 1.0.4 | |
| High | 8.8 | CVE-2024-11443 | de:brandingAuthenticated (Subscriber+) Arbitrary Options Update | ≤ 1.0.2 | |
| High | 8.8 | CVE-2024-54352 | SogridCross-Site Request Forgery to Arbitrary Options Update | ≤ 1.5.2 | |
| High | 8.8 | CVE-2024-54378 | Quietly InsightsMissing Authorization to Authenticated (Subscriber+) Arbitrary Options Update | ≤ 1.2.2 | |
| High | 8.8 | CVE-2024-54379 | MinterpressMissing Authorization to Authenticated (Subscriber+) Arbitrary Options Update | ≤ 1.0.5 | |
| High | 8.8 | CVE-2024-54365 | KH Easy User SettingsAuthenticated (Subscriber+) Privilege Escalation | ≤ 1.0.0 | |
| High | 8.8 | CVE-2024-54248 | eewee admin customCross-Site Request Forgery to Privilege Escalation | ≤ 1.8.2.4 | |
| High | 8.8 | CVE-2024-52488 | Multiple Themes - Authenticated (Subscriber+) Arbitrary Plugin Activation and Deactivation | — | |
| High | 8.8 | CVE-2024-52446 | Buying Buddy IDX CRMCross-Site Request Forgery to PHP Object Injection | ≤ 1.2.8 | |
| High | 8.8 | CVE-2024-52429 | WP Quick SetupMissing Authorization to Authenticated (Subscriber+) Arbitrary Plugin/Theme Installation | ≤ 2.0 | |
| High | 8.8 | CVE-2024-52399 | Writer HelperAuthenticated (Subscriber+) Arbitrary File Upload | ≤ 3.1.6 | |
| High | 8.8 | CVE-2024-52415 | SK WP Settings BackupCross-Site Request Forgery to PHP Object Injection | ≤ 1.0 | |
| High | 8.8 | CVE-2024-50408 | Namaste! LMSAuthenticated (Subscriber+) PHP Object Injection | ≤ 2.6.3 | |
| High | 8.8 | CVE-2024-49608 | GERRYWORKS Post by MailContributor+ Privilege Escalation | ≤ 1.0 | |
| High | 8.8 | CVE-2024-31094 | Filter Custom Fields & Taxonomies LightAuthenticated (Contributor+) PHP Object Injection | ≤ 1.05 | |
| High | 8.8 | CVE-2023-44478 | Events Rich Snippets for GoogleCross-Site Request Forgery to Arbitrary Options Update | ≤ 1.8 | |
| High | 8.8 | CVE-2023-23879 | PHP ExecutionCross Site Request Forgery | ≤ 1.0.0 | |
| High | 8.8 | CVE-2023-23721 | Admin LogCross-Site Request Forgery | ≤ 1.50 | |
| High | 8.8 | CVE-2022-46867 | Universal Star RatingCross-Site Request Forgery | ≤ 2.1.0 | |
| High | 8.8 | CVE-2022-47611 | Hover ImageCross-Site Request Forgery | ≤ 1.4.1 | |
| High | 8.8 | CVE-2022-41650 | Custom Content by CountryCross-Site Request Forgery | ≤ 3.1.2 | |
| High | 8.8 | CVE-2022-44585 | Homepage PopUpCross-Site Request Forgery | ≤ 1.2.5 | |
| High | 8.8 | CVE-2022-36404 | Simple SEOCross-Site Request Forgery to Sitemap Deletion/Creation | ≤ 1.8.12 | |
| High | 8.8 | CVE-2022-44627 | Simple SEOCross-Site Request Forgery | ≤ 1.8.12 | |
| High | 8.8 | CVE-2022-40131 | Page View CountCross-Site Request Forgery | ≤ 2.5.5 | |
| High | 8.1 | CVE-2024-49249 | SMSA ShippingAuthenticated (Subscriber+) Arbitrary File Deletion | ≤ 2.3 | |
| High | 8.1 | CVE-2025-53588 | UPC/EAN/GTIN Code GeneratorAuthenticated (Subscriber+) Arbitrary File Deletion | ≤ 2.0.2 | |
| High | 8.1 | CVE-2025-23562 | XLSXviewerAuthenticated (Subscriber+) Arbitrary File Deletion | ≤ 2.1.1 | |
| High | 8.1 | CVE-2024-50507 | DS.DownloadListUnauthenticated PHP Object Injection | ≤ 1.3 | |
| High | 8.1 | CVE-2023-46615 | KD Coming SoonUnauthenticated PHP Object Injection via cetitle | ≤ 1.7 | |
| High | 8.1 | CVE-2023-23861 | GMAceCross-Site Request Forgery via gmace_manager_client | ≤ 1.5.2 | |
| High | 7.6 | CVE-2023-45828 | RumbleTalk Live Group ChatMissing Authorization via handleRequest | ≤ 6.1.9 | |
| High | 7.5 | CVE-2024-53805 | WP MailsterMissing Authorization | ≤ 1.8.16.0 | |
| High | 7.5 | CVE-2023-47224 | WP TravelMissing Authorization via Multiple AJAX Actions | ≤ 7.7.0 | |
| High | 7.5 | CVE-2023-40211 | Post GridMissing Authorization to Sensitive Information Exposure via REST API | ≤ 2.2.50 | |
| High | 7.4 | CVE-2023-36527 | Post to CSV by BestWebSoftAuthenticated (Author+) CSV Injection | ≤ 1.4.0 | |
| High | 7.3 | CVE-2023-41686 | Woocommerce Support SystemMissing Authorization | ≤ 1.2.2 | |
| High | 7.3 | CVE-2023-37969 | Checkout with Zelle on WoocommerceMissing Authorization | ≤ 3.1 | |
| High | 7.2 | CVE-2025-32527 | T&P Gallery SliderUnauthenticated Stored Cross-Site Scripting | ≤ 1.2 | |
| High | 7.2 | CVE-2025-22632 | WooCommerce Pricing – Product PricingUnauthenticated Stored Cross-Site Scripting | ≤ 1.0.9 | |
| High | 7.2 | CVE-2025-24570 | AtarimUnauthenticated Stored Cross-Site Scripting | ≤ 4.0.8 | |
| High | 7.2 | CVE-2025-23535 | REAL WordPress SidebarUnauthenticated Stored Cross-Site Scripting | ≤ 0.1 | |
| High | 7.2 | CVE-2025-24641 | Better WishList APIUnauthenticated Stored Cross-Site Scripting | ≤ 1.1.3 | |
| High | 7.2 | CVE-2025-24620 | Best WordPress Shortcode Plugin in 2025 – AIO ShortcodesUnauthenticated Stored Cross-Site Scripting | ≤ 1.3.0 | |
| High | 7.2 | CVE-2024-56008 | Spreadr WoocommerceMissing Authorization to Arbitrary Content Deletion | ≤ 1.0.4 | |
| High | 7.2 | CVE-2024-54282 | WP Mega MenuAuthenticated (Administrator+) PHP Object Injection | ≤ 1.4.2 | |
| High | 7.2 | CVE-2024-30551 | Sticky AnythingUnauthenticated Stored Cross-Site Scripting | ≤ 2.1.5 | |
| High | 7.2 | CVE-2023-49764 | Advanced Database CleanerAuthenticated (Administrator+) SQL Injection | ≤ 3.1.2 | |
| High | 7.2 | CVE-2023-49166 | MSyncAuthenticated (Administrator+) SQL Injection | ≤ 1.0.0 | |
| High | 7.2 | CVE-2023-48741 | ChatBotAuthenticated (Administrator+) SQL Injection | ≤ 4.7.8 | |
| High | 7.2 | CVE-2023-48742 | License Manager for WooCommerceAuthenticated (Administrator+) SQL Injection | ≤ 2.2.10 | |
| High | 7.2 | CVE-2023-46207 | Motors – Car Dealer & Classified AdsServer Side Request Forgery | ≤ 1.4.6 | |
| High | 7.2 | CVE-2023-41860 | Travel MapUnauthenticated Cross-Site Scripting | ≤ 1.0.1 | |
| High | 7.2 | CVE-2023-41685 | Woocommerce Support SystemAuthenticated (Administrator+) SQL Injection via 'orderby' | ≤ 1.2.1 | |
| High | 7.2 | CVE-2023-34168 | WP Report PostAuthenticated (Editor+) SQL Injection | ≤ 2.1.2 | |
| High | 7.2 | CVE-2023-33924 | SIS HandballAuthenticated (Administrator+) SQL Injection via 'orderby' | ≤ 1.0.45 | |
| High | 7.2 | CVE-2023-32128 | Cryptocurrency Donation Box – Bitcoin & Crypto DonationsAuthenticated (Administrator+) SQL Injection | ≤ 2.2.7 | |
| High | 7.2 | CVE-2023-27605 | WP Reroute EmailAuthenticated (Administrator+) SQL Injection | ≤ 1.4.6 | |
| High | 7.2 | CVE-2023-27610 | Transbank Webpay RESTAuthenticated (Administrator+) SQL Injection via orderby | ≤ 1.6.6 | |
| High | 7.2 | CVE-2022-46803 | Simple Newsletter Plugin – NoptinUnauthenticated CSV Injection | ≤ 1.10.3 | |
| High | 7.2 | CVE-2022-43462 | IP Blacklist CloudAuthenticated (Administrator+) SQL Injection | ≤ 5.00 | |
| High | 7.2 | CVE-2022-3131 | Search LoggerAuthenticated (Administrator+) SQL Injection | ≤ 0.9 | |
| High | 7.2 | CVE-2022-3076 | CM Download ManagerAuthenticated (Administrator+) Arbitrary File Upload | ≤ 2.8.5 | |
| High | 7.1 | CVE-2025-23529 | MinterpressMissing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion | ≤ 1.0.5 | |
| High | 7.1 | CVE-2023-27424 | Inactive User DeleterCross-Site Request Forgery via Multiple Functions | ≤ 1.59 | |
| Medium | 6.6 | CVE-2023-50843 | Clockwork SMS NotficationsAuthenticated(Administrator+) SQL Injection | ≤ 3.0.4 | |
| Medium | 6.6 | CVE-2023-48764 | WordPress Brute Force Protection – Stop Brute Force AttacksAuthenticated (Administrator+) SQL Injection via orderby | ≤ 2.2.5 | |
| Medium | 6.5 | CVE-2025-23958 | Editor Wysiwyg Background ColorMissing Authorization | ≤ 1.0 | |
| Medium | 6.5 | CVE-2025-23486 | Database SyncAuthenticated (Subscriber+) Sensitive Information Exposure | ≤ 0.5.1 | |
| Medium | 6.5 | CVE-2025-23527 | WC WalletMissing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion | ≤ 2.2.0 | |
| Medium | 6.5 | CVE-2025-23906 | WordPress Dashboard TweeterMissing Authorization | ≤ 1.3.2 | |
| Medium | 6.5 | CVE-2025-24639 | Korea for WooCommerceAuthenticated (Subscriber+) Sensitive Information Exposure | ≤ 1.1.11 | |
| Medium | 6.5 | CVE-2025-24597 | Barcode Generator for WooCommerce – Show barcodes on products, orders, invoices and other pagesAuthenticated (Subscriber+) Sensitive Information Disclosure | ≤ 2.0.2 | |
| Medium | 6.5 | CVE-2024-56009 | Spreadr WoocommerceMissing Authorization | ≤ 1.0.4 | |
| Medium | 6.5 | CVE-2024-55991 | WordPress CRM Plugin – WP-CRM SystemMissing Authorization | ≤ 3.2.9.1 | |
| Medium | 6.5 | CVE-2024-55995 | Torod – The smart shipping and delivery portal for e-shops and retailersMissing Authorization to Unauthenticated Plugin Settings Update | ≤ 1.7 | |
| Medium | 6.5 | CVE-2024-53803 | WP MailsterMissing Authorization | ≤ 1.8.16.0 | |
| Medium | 6.5 | CVE-2024-53708 | AI QuizMissing Authorization | ≤ 1.1 | |
| Medium | 6.5 | CVE-2024-24849 | Quicksand Post Filter jQuery PluginCross-Site Request Forgery via renderAdmin | ≤ 3.1.1 | |
| Medium | 6.5 | CVE-2023-47698 | Japanized For WooCommerceMissing Authorization | ≤ 2.6.4 | |
| Medium | 6.5 | CVE-2023-46631 | Product Recommendation Quiz for eCommerceMissing Authorization in prq_set_token | ≤ 2.1.0 | |
| Medium | 6.5 | CVE-2023-46608 | DoLogin SecurityMissing Authorization via REST Endpoints | ≤ 3.7.1 | |
| Medium | 6.5 | CVE-2023-46195 | Headline AnalyzerMissing Authorization via REST APIs | ≤ 1.3.1 | |
| Medium | 6.5 | CVE-2023-37865 | Download IP2Location Country BlockerBypass via IP Spoofing | ≤ 2.29.1 | |
| Medium | 6.5 | CVE-2023-34019 | Uncanny Toolkit for LearnDashMissing Authorization via review-banner-visibility REST route | ≤ 3.6.4.3 | |
| Medium | 6.5 | CVE-2022-46809 | ReviewXUnauthenticated CSV Injection | ≤ 1.6.7 | |
| Medium | 6.5 | CVE-2023-24416 | All In One FaviconAuthenticated(Admin+) Directory Traversal | ≤ 4.7 | |
| Medium | 6.5 | CVE-2022-45810 | Icegram ExpressUnauthenticated CSV Injection | ≤ 5.5.2 | |
| Medium | 6.5 | CVE-2022-45360 | Commenter EmailsUnauthenticated CSV Injection | ≤ 2.6.1 | |
| Medium | 6.5 | CVE-2022-46801 | Site ReviewsUnauthenticated CSV Injection | ≤ 6.2.0 | |
| Medium | 6.4 | CVE-2025-62901 | WP MicrodataAuthenticated (Contributor+) Stored Cross-Site Scripting | ≤ 1.0 | |
| Medium | 6.4 | CVE-2025-58871 | Master Paper Collapse ToggleAuthenticated (Contributor+) Stored Cross-Site Scripting | ≤ 1.1 | |
| Medium | 6.4 | CVE-2025-58858 | WPB Image WidgetAuthenticated (Contributor+) Stored Cross-Site Scripting | ≤ 1.1 | |
| Medium | 6.4 | CVE-2025-58864 | 金数据Authenticated (Contributor+) Stored Cross-Site Scripting | ≤ 1.0 | |
| Medium | 6.4 | CVE-2025-58836 | FW AnkerAuthenticated (Contributor+) Stored Cross-Site Scripting | ≤ 1.2.6 | |
| Medium | 6.4 | CVE-2025-58867 | Easy Download Media CounterAuthenticated (Contributor+) Stored Cross-Site Scripting | ≤ 1.2 | |
| Medium | 6.4 | CVE-2025-58862 | WordPress Events Calendar Plugin – connectDailyAuthenticated (Contributor+) Stored Cross-Site Scripting | ≤ 1.5.4 | |
| Medium | 6.4 | CVE-2025-58868 | SimaCookieAuthenticated (Contributor+) Stored Cross-Site Scripting | ≤ 1.3.2 | |
| Medium | 6.4 | CVE-2025-58830 | Parallax Scrolling Enllax.jsAuthenticated (Contributor+) Stored Cross-Site Scripting | ≤ 0.0.6 | |
| Medium | 6.4 | CVE-2025-58851 | Boxed ContentAuthenticated (Contributor+) Stored Cross-Site Scripting | ≤ 1.0 | |
| Medium | 6.4 | CVE-2025-58876 | Aparat Video ShortcodeAuthenticated (Contributor+) Stored Cross-Site Scripting | ≤ 0.2.4 | |
| Medium | 6.4 | CVE-2025-15659 | ElizaibotsAuthenticated (Contributor+) Stored Cross-Site Scripting | ≤ 1.0.2 | |
| Medium | 6.4 | CVE-2025-49893 | ElizaibotsAuthenticated (Contributor+) Stored Cross-Site Scripting | ≤ 1.0.2 | |
| Medium | 6.4 | CVE-2025-49061 | Porn Videos EmbedAuthenticated (Contributor+) Stored Cross-Site Scripting | ≤ 0.9.1 | |
| Medium | 6.4 | CVE-2025-49960 | LeadBI Plugin for WordPressAuthenticated (Subscriber+) Stored Cross-Site Scripting | ≤ 1.7 | |
| Medium | 6.4 | CVE-2025-32211 | BroadstreetAuthenticated (Subscriber+) Stored Cross-Site Scripting | ≤ 1.52.1 | |
| Medium | 6.4 | CVE-2025-32185 | Colibri Page BuilderAuthenticated (Contributor+) Stored Cross-Site Scripting | ≤ 1.0.319 | |
| Medium | 6.4 | CVE-2025-31407 | TigerAuthenticated (Subscriber+) Stored Cross-Site Scripting | ≤ 2.0 | |
| Medium | 6.4 | CVE-2025-22653 | Music Press ProAuthenticated (Contributor+) Stored Cross-Site Scripting | ≤ 1.4.6 | |
| Medium | 6.4 | CVE-2025-24575 | HelloAssoAuthenticated (Contributor+) Stored Cross-Site Scripting | ≤ 1.1.11 | |
| Medium | 6.4 | CVE-2025-23561 | MLL Audio Player MP3 AjaxAuthenticated (Subscriber+) Stored Cross-Site Scripting | ≤ 0.7 | |
| Medium | 6.4 | CVE-2023-47229 | Download Top 25 Social IconsAuthenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | ≤ 3.1 | |
| Medium | 6.4 | CVE-2023-45646 | PDF BlockAuthenticated (Contributor+) Stored Cross-Site Scripting | ≤ 1.1.0 | |
| Medium | 6.4 | CVE-2023-45628 | QR Twitter WidgetAuthenticated (Contributor+) Stored Cross-Site Scripting via shortcode | ≤ 0.2.3 | |
| Medium | 6.4 | CVE-2023-45059 | GumroadAuthenticated (Contributor+) Stored Cross-Site Scripting | ≤ 3.1.0 | |
| Medium | 6.4 | CVE-2023-27628 | SitekitAuthenticated (Contributor+) Stored Cross-Site Scripting via 'sitekit_iframe ' shortcode | ≤ 1.3 | |
| Medium | 6.4 | CVE-2023-40197 | flowpaperAuthenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | ≤ 1.9.9 | |
| Medium | 6.4 | CVE-2023-32102 | Library ViewerAuthenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | ≤ 2.0.6 | |
| Medium | 6.4 | CVE-2023-31079 | TippyAuthenticated (Contributor+) Stored Cross-Site Scripting via tippy shortcode | ≤ 6.2.1 | |
| Medium | 6.4 | CVE-2023-30784 | Kaya QR Code GeneratorAuthenticated (Contributor+) Stored Cross-Site Scripting via qrCode attribute | ≤ 1.5.2 | |
| Medium | 6.4 | CVE-2023-29435 | Cryptocurrency All-in-OneAuthenticated (Contributor+) Stored Cross-Site Scripting | ≤ 3.0.19 | |
| Medium | 6.4 | CVE-2023-29436 | IFrame ShortcodeAuthenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | ≤ 1.0.5 | |
| Medium | 6.4 | CVE-2023-27629 | Site ReviewsAuthenticated (Contributor+) Stored Cross-Site Scripting via block attribute | ≤ 6.5.1 | |
| Medium | 6.4 | CVE-2023-27443 | Simple Vimeo ShortcodeAuthenticated (Contributor+) Stored Cross-Site Scripting via shortcode | ≤ 2.9.1 | |
| Medium | 6.4 | CVE-2023-26536 | Sp*tify Play Button for WordPressAuthenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | ≤ 2.05 | |
| Medium | 6.3 | CVE-2023-45652 | Remote Content ShortcodeAuthenticated(Contributor+) Local File Inclusion via shortcode | ≤ 1.5 | |
| Medium | 6.3 | CVE-2022-41791 | ProfileGridAuthenticated (Subscriber+) CSV Injection | ≤ 5.1.7 | |
| Medium | 6.1 | CVE-2025-32520 | WordPress Health and Server Condition – Integrated with Google Page SpeedReflected Cross-Site Scripting | ≤ 4.1.1 | |
| Medium | 6.1 | CVE-2025-32506 | AT Internet SmartTagReflected Cross-Site Scripting | ≤ 0.2 | |
| Medium | 6.1 | CVE-2025-31418 | GravelReflected Cross-Site Scripting | ≤ 1.6 | |
| Medium | 6.1 | CVE-2025-31898 | MediaViewReflected Cross-Site Scripting | ≤ 1.1.2 | |
| Medium | 6.1 | CVE-2025-31027 | TigerReflected Cross-Site Scripting | ≤ 2.0 | |
| Medium | 6.1 | CVE-2025-23608 | LIVE TVReflected Cross-Site Scripting | ≤ 1.2 | |
| Medium | 6.1 | CVE-2025-23554 | Off Page SEOReflected Cross-Site Scripting | ≤ 3.0.3 | |
| Medium | 6.1 | CVE-2025-23459 | NS Simple Intro LoaderReflected Cross-Site Scripting | ≤ 2.2.3 | |
| Medium | 6.1 | CVE-2025-23460 | RWS Enquiry And Lead Follow-upReflected Cross-Site Scripting | ≤ 1.0 | |
| Medium | 6.1 | CVE-2025-23466 | Site Editor Google MapReflected Cross-Site Scripting | ≤ 1.0.1 | |
| Medium | 6.1 | CVE-2025-23469 | SleekplanReflected Cross-Site Scripting | ≤ 0.2.0 | |
| Medium | 6.1 | CVE-2025-23458 | Ads24 LiteReflected Cross-Site Scripting | ≤ 1.0 | |
| Medium | 6.1 | CVE-2025-23461 | Social2BlogReflected Cross-Site Scripting | ≤ 0.2.990 | |
| Medium | 6.1 | CVE-2025-23462 | FWD SliderReflected Cross-Site Scripting | ≤ 1.0 | |
| Medium | 6.1 | CVE-2025-23604 | Rezdy ReloadedUnauthenticated Stored Cross-Site Scripting | ≤ 1.0.1 | |
| Medium | 6.1 | CVE-2025-23752 | CGD Arrange TermsReflected Cross-Site Scripting | ≤ 1.1.3 | |
| Medium | 6.1 | CVE-2025-23756 | LawPress – Law Firm Website ManagementReflected Cross-Site Scripting | ≤ 1.4.5 | |
| Medium | 6.1 | CVE-2025-23754 | The LoopsReflected Cross-Site Scripting | ≤ 1.0.2 | |
| Medium | 6.1 | CVE-2025-23431 | Envato AffiliaterReflected Cross-Site Scripting | ≤ 1.2.4 | |
| Medium | 6.1 | CVE-2025-23439 | TinyMCE Extended ConfigReflected Cross-Site Scripting | ≤ 0.1.0 | |
| Medium | 6.1 | CVE-2025-23465 | Vampire Character ManagerReflected Cross-Site Scripting | ≤ 2.13 | |
| Medium | 6.1 | CVE-2025-23468 | Essay Wizard (wpCRES)Reflected Cross-Site Scripting | ≤ 1.0.6.4 | |
| Medium | 6.1 | CVE-2025-23539 | Awesome HooksReflected Cross-Site Scripting | ≤ 1.0.1 | |
| Medium | 6.1 | CVE-2025-23563 | Explore pagesReflected Cross-Site Scripting | ≤ 1.01 | |
| Medium | 6.1 | CVE-2025-23556 | Push Envoy NotificationsReflected Cross-Site Scripting | ≤ 1.0.0 | |
| Medium | 6.1 | CVE-2025-23741 | Notifications CenterReflected Cross-Site Scripting | ≤ 1.5.2 | |
| Medium | 6.1 | CVE-2025-23740 | Easy School RegistrationReflected Cross-Site Scripting | ≤ 3.9.8 | |
| Medium | 6.1 | CVE-2025-23760 | ChatterCross-Site Request Forgery to Stored Cross-Site Scripting | ≤ 1.0.1 | |
| Medium | 6.1 | CVE-2025-22338 | WP-tagMakerReflected Cross-Site Scripting | ≤ 0.2.2 | |
| Medium | 6.1 | CVE-2025-22344 | Media Category LibraryReflected Cross-Site Scripting | ≤ 2.7 | |
| Medium | 6.1 | CVE-2024-56027 | Leads CRMReflected Cross-Site Scripting | ≤ 2.0.13 | |
| Medium | 6.1 | CVE-2024-56028 | Lemonade Social Networks Autoposter PinterestReflected Cross-Site Scripting | ≤ 2.0 | |
| Medium | 6.1 | CVE-2024-56026 | Simple ProxyReflected Cross-Site Scripting | ≤ 1.0 | |
| Medium | 6.1 | CVE-2024-56023 | WP eCommerce QuickpayReflected Cross-Site Scripting | ≤ 1.1.0 | |
| Medium | 6.1 | CVE-2024-56016 | Image MapperReflected Cross-Site Scripting | ≤ 0.2.5.3 | |
| Medium | 6.1 | CVE-2025-24574 | PeproDev WooCommerce Receipt UploaderReflected Cross-Site Scripting | ≤ 2.6.9 | |
| Medium | 6.1 | CVE-2024-54325 | CarDealerPressReflected Cross-Site Scripting | ≤ 6.6.2410.02 | |
| Medium | 6.1 | CVE-2024-54322 | Media DownloaderReflected Cross-Site Scripting | ≤ 0.4.7.4 | |
| Medium | 6.1 | CVE-2024-54324 | SMSifyReflected Cross-Site Scripting | ≤ 6.0.4 | |
| Medium | 6.1 | CVE-2024-54288 | LDD Directory LiteReflected Cross-Site Scripting | ≤ 3.3 | |
| Medium | 6.1 | CVE-2024-54233 | Advanced Control Manager for WordPress by ItalyStrapReflected Cross-Site Scripting | ≤ 2.16.0 | |
| Medium | 6.1 | CVE-2024-52470 | Dynamic URL SEOUnauthenticated Cross-Site Scripting | ≤ 1.0 | |
| Medium | 6.1 | CVE-2024-52452 | Open edX LMSReflected Cross-Site Scripting | ≤ 2.6.1 | |
| Medium | 6.1 | CVE-2024-52466 | Explara EventsReflected Cross-Site Scripting | ≤ 0.1.3 | |
| Medium | 6.1 | CVE-2024-52454 | GoQMierucaReflected Cross-Site Scripting | ≤ 1.0.0 | |
| Medium | 6.1 | CVE-2024-52455 | GoQSmileReflected Cross-Site Scripting | ≤ 1.0.1 | |
| Medium | 6.1 | CVE-2024-52453 | Library BookshelvesReflected Cross-Site Scripting | ≤ 5.8 | |
| Medium | 6.1 | CVE-2024-52463 | Post By EmailReflected Cross-Site Scripting | ≤ 1.0.4b | |
| Medium | 6.1 | CVE-2024-52469 | WooCommerce Price AlertReflected Cross-Site Scripting | ≤ 1.0.4 | |
| Medium | 6.1 | CVE-2025-24534 | DPortfolioReflected Cross-Site Scripting | ≤ 2.0 | |
| Medium | 6.1 | CVE-2025-24541 | DK White LabelReflected Cross-Site Scripting | ≤ 1.0 | |
| Medium | 6.1 | CVE-2024-51760 | Dashing MembershipsReflected Cross-Site Scripting | ≤ 1.1 | |
| Medium | 6.1 | CVE-2024-51782 | LoginplusUnauthenticated Stored Cross-Site Scripting | ≤ 1.2 | |
| Medium | 6.1 | CVE-2024-51762 | PropertyShiftReflected Cross-Site Scripting | ≤ 1.0.0 | |
| Medium | 6.1 | CVE-2024-51763 | Team Showcase and Slider – Team Members BuilderReflected Cross-Site Scripting | ≤ 1.3 | |
| Medium | 6.1 | CVE-2024-51761 | WPHelpfulReflected Cross-Site Scripting | ≤ 1.2.4 | |
| Medium | 6.1 | CVE-2024-49640 | ACL Floating Cart for WooCommerceReflected Cross-Site Scripting | ≤ 0.9 | |
| Medium | 6.1 | CVE-2024-49650 | BuddyPress Greeting MessageReflected Cross-Site Scripting | ≤ 1.0.3 | |
| Medium | 6.1 | CVE-2024-49660 | Campus Explorer WidgetReflected Cross-Site Scripting | ≤ 1.4 | |
| Medium | 6.1 | CVE-2024-49664 | chatplusjpReflected Cross-Site Scripting | ≤ 1.02 | |
| Medium | 6.1 | CVE-2024-49646 | Code GenerateReflected Cross-Site Scripting | ≤ 1.0 | |
| Medium | 6.1 | CVE-2024-49656 | DocumentPressReflected Cross-Site Scripting | ≤ 2.1 | |
| Medium | 6.1 | CVE-2024-49654 | Extra Privacy for ElementorReflected Cross-Site Scripting | ≤ 0.1.3 | |
| Medium | 6.1 | CVE-2024-49643 | WhitelistReflected Cross-Site Scripting | ≤ 3.5 | |
| Medium | 6.1 | CVE-2024-49639 | Monitor.chatReflected Cross-Site Scripting | ≤ 1.1.1 | |
| Medium | 6.1 | CVE-2024-49638 | Risk Warning BarReflected Cross-Site Scripting | ≤ 1.0 | |
| Medium | 6.1 | CVE-2024-49647 | Simple Custom AdminReflected Cross-Site Scripting | ≤ 1.2 | |
| Medium | 6.1 | CVE-2024-49662 | Simple Load MoreReflected Cross-Site Scripting | ≤ 1.0 | |
| Medium | 6.1 | CVE-2024-49645 | Affiliate PlatformReflected Cross-Site Scripting | ≤ 1.4.8 | |
| Medium | 6.1 | CVE-2024-49648 | SVG CaptchaReflected Cross-Site Scripting | ≤ 1.0.11 | |
| Medium | 6.1 | CVE-2024-49641 | Tida URL ScreenshotReflected Cross-Site Scripting | ≤ 1.0.1 | |
| Medium | 6.1 | CVE-2024-49642 | Todo Custom FieldReflected Cross-Site Scripting | ≤ 3.0.4 | |
| Medium | 6.1 | CVE-2024-49663 | uCAT – Next StoryReflected Cross-Site Scripting | ≤ 2.0.0 | |
| Medium | 6.1 | CVE-2024-49651 | WooCommerce Maintenance ModeReflected Cross-Site Scripting | ≤ 2.0.1 | |
| Medium | 6.1 | CVE-2024-49224 | Mitm Bug TrackerReflected Cross-Site Scripting | ≤ 1.0 | |
| Medium | 6.1 | CVE-2024-48032 | Featured Posts with Multiple Custom Groups (FPMCG)Reflected Cross-Site Scripting | ≤ 4.0 | |
| Medium | 6.1 | CVE-2024-48023 | Restaurant Reservations WidgetReflected Cross-Site Scripting | ≤ 1.0 | |
| Medium | 6.1 | CVE-2024-25921 | Action NetworkReflected Cross-Site Scripting via 'search' | ≤ 1.4.2 | |
| Medium | 6.1 | CVE-2023-49771 | Smart External Link Click Monitor [Link Log]Reflected Cross-Site Scripting | ≤ 5.0.2 | |
| Medium | 6.1 | CVE-2023-48272 | Maspik – Spam blacklistUnauthenticated Stored Cross-Site Scripting via efas_add_to_log | ≤ 0.9.2 | |
| Medium | 6.1 | CVE-2023-47665 | Plainview Protect PasswordsReflected Cross-Site Scripting | ≤ 1.4 | |
| Medium | 6.1 | CVE-2023-46208 | Motors – Car Dealer & Classified AdsReflected Cross-Site Scripting | ≤ 1.4.6 | |
| Medium | 6.1 | CVE-2023-41692 | AttorneyReflected Cross-Site Scripting | ≤ 3 | |
| Medium | 6.1 | CVE-2023-40214 | Business ProReflected Cross-Site Scripting | ≤ 1.10.4 | |
| Medium | 6.1 | CVE-2023-23887 | Easy Google Analytics for WordPressCross-Site Request Forgery | ≤ 1.6.0 | |
| Medium | 6.1 | CVE-2022-45370 | WordPress Comments Import & ExportCSV Injection | ≤ 2.3.1 | |
| Medium | 6.1 | CVE-2024-27948 | AtahualpaCross-Site Scripting via Cross-Site Request Forgery | ≤ 3.7.24 | |
| Medium | 6 | CVE-2022-46821 | Emails & Newsletters with JackmailAuthenticated (Subscriber+) CSV Injecton | ≤ 1.2.22 | |
| Medium | 6 | CVE-2022-41616 | Export Users Data CSVAuthenticated (Subscriber+) CSV Injection | ≤ 2.1 | |
| Medium | 5.9 | CVE-2022-45078 | User BlockerAuthenticated (Admin+) CSV Injection | ≤ 1.5.5 | |
| Medium | 5.5 | CVE-2024-24834 | BEARAuthenticated (Shop manager+) Stored Cross-Site Scripting via Plugin Options | ≤ 1.1.4 | |
| Medium | 5.5 | CVE-2023-31219 | Download MonitorAuthenticated (Admin+) Server-Side Request Forgery | ≤ 4.8.1 | |
| Medium | 5.5 | CVE-2022-46804 | Export Users Data DistinctAuthenticated (Subscriber+) CSV Injection | ≤ 1.3 | |
| Medium | 5.5 | CVE-2022-45348 | amr usersAuthenticated (Subscriber+) CSV Injection | ≤ 4.59.4 | |
| Medium | 5.5 | CVE-2022-44738 | Posts and Users StatsAuthenticated (Subscriber+) CSV Injection | ≤ 1.1.3 | |
| Medium | 5.5 | CVE-2022-47598 | WP Super PopupAuthenticated (Administrator+) Stored Cross-Site Scripting | ≤ 1.1.2 | |
| Medium | 5.5 | CVE-2023-22680 | No API Amazon AffiliateAuthenticated (Administrator+) Stored Cross-Site Scripting | ≤ 4.2.2 | |
| Medium | 5.5 | CVE-2023-22679 | WP Better EmailsAuthenticated (Administrator+) Stored Cross-Site Scripting | ≤ 0.4 | |
| Medium | 5.5 | CVE-2022-40694 | News Announcement ScrollAuthenticated (Admininstrator+) Stored Cross-Site Scripting | ≤ 8.8.8 | |
| Medium | 5.5 | CVE-2022-43480 | Homepage PopupAuthenticated (Administrator+) Stored Cross-Site Scripting | ≤ 1.2.5 | |
| Medium | 5.5 | CVE-2022-42462 | IP Blacklist CloudAuthenticated (Administrator+) Stored Cross-Site Scripting | ≤ 5.00 | |
| Medium | 5.5 | CVE-2022-41980 | Mantenimiento webAuthenticated (Administrator+) Stored Cross-Site Scripting | ≤ 0.13 | |
| Medium | 5.5 | CVE-2022-36428 | Rock ConvertAuthenticated (Admin+) Stored Cross-Site Scripting | ≤ 2.11.0 | |
| Medium | 5.5 | CVE-2022-38068 | Export Post InfoAuthenticated (Administrator+) Stored Cross-Site Scripting | ≤ 1.1.0 | |
| Medium | 5.5 | CVE-2022-3132 | Goolytics – Simple Google AnalyticsAuthenticated (Administrator+) Stored Cross-Site Scripting | ≤ 1.1.1 | |
| Medium | 5.5 | CVE-2022-2799 | Affiliates ManagerAuthenticated (Administrator+) Stored Cross-Site Scripting | ≤ 2.9.13 | |
| Medium | 5.5 | CVE-2022-1228 | OpenseaCross-Site Scripting | ≤ 1.0.2 | |
| Medium | 5.5 | CVE-2022-0876 | Social comments by WpDevArtAdmin+ Stored Cross-Site Scripting | ≤ 2.4.9 | |
| Medium | 5.5 | CVE-2022-0590 | BulletProof SecurityAdmin+ Stored Cross-Site Scripting | ≤ 5.7 | |
| Medium | 5.5 | CVE-2021-24841 | HelpfulAdmin+ Stored Cross-Site Scripting | ≤ 4.4.58 | |
| Medium | 5.4 | CVE-2024-55998 | Popup Surveys & Polls for WordPress (Mare.io)Missing Authorization | ≤ 1.36 | |
| Medium | 5.4 | CVE-2024-56002 | Contact Form, Survey & Form Builder – MightyFormsMissing Authorization | ≤ 1.3.9 | |
| Medium | 5.4 | CVE-2024-53798 | FloristPressMissing Authorization to Arbitrary Content Deletion | ≤ 7.3.0 | |
| Medium | 5.4 | CVE-2023-41671 | Abandoned Cart Lite for WooCommerceMissing Authorization via multiple AJAX functions | ≤ 5.16.1 | |
| Medium | 5.4 | CVE-2023-46198 | Appointment CalendarCross-Site Request Forgery | ≤ 2.9.6 | |
| Medium | 5.4 | CVE-2023-45606 | Simple URLsCross-Site Request Forgery via Multiple AJAX Actions | ≤ 120 | |
| Medium | 5.4 | CVE-2023-45106 | Urvanov Syntax HighlighterCross-Site Request Forgery via init_ajax | ≤ 2.8.33 | |
| Medium | 5.4 | CVE-2023-45270 | Pinpoint Booking SystemCross-Site Request Forgery via initBackEndAJAX | ≤ 2.9.9.4.0 | |
| Medium | 5.4 | CVE-2023-45269 | Simple SEOCross-Site Request Forgery via multiple admin_post functions | ≤ 2.0.25 | |
| Medium | 5.4 | CVE-2023-41697 | Easy WP CleanerCross-Site Request Forgery | ≤ 1.9 | |
| Medium | 5.4 | CVE-2023-41239 | PowerPressAuthenticated (Contributor+) Server-Side Request Forgery via wp_ajax_powerpress_media_info | ≤ 11.0.6 | |
| Medium | 5.4 | CVE-2023-40561 | WooCommerce Enhanced Ecommerce Analytics Integration with Conversion TrackingCross-Site Request Forgery | ≤ 3.7.1 | |
| Medium | 5.4 | CVE-2023-27435 | HTTP AuthCross-Site Request Forgery | ≤ 0.3.2 | |
| Medium | 5.4 | CVE-2023-25788 | Saphali Woocommerce LiteCross-Site Request Forgery via 'woocommerce_saphali_page_s_l' | ≤ 1.8.13 | |
| Medium | 5.4 | CVE-2023-37971 | WooCommerce Product Stock AlertMissing Authorization via API | ≤ 2.0.1 | |
| Medium | 5.4 | CVE-2023-33207 | Stop Referrer SpamCross-Site Request Forgery via processParameters | ≤ 1.3.0 | |
| Medium | 5.4 | CVE-2023-32798 | Simple Page OrderingMissing Authorization to Information Disclosure | ≤ 2.5.0 | |
| Medium | 5.4 | CVE-2023-32583 | WP All BackupCross-Site Request Forgery to Backup Storage Modification | ≤ 2.4.3 | |
| Medium | 5.4 | CVE-2023-32588 | Post State TagsCross-Site Request Forgery to Settings Reset | ≤ 2.0.6 | |
| Medium | 5.4 | CVE-2023-32594 | HyphenatorCross-Site Request Forgery to Settings Update | ≤ 5.1.5 | |
| Medium | 5.4 | CVE-2023-32101 | Library ViewerOpen Redirect via 'redirect_to' | ≤ 2.0.6 | |
| Medium | 5.4 | CVE-2023-31086 | Simple GiveawaysCross-Site Request Forgery | ≤ 2.46 | |
| Medium | 5.4 | CVE-2023-30778 | PowerPressAuthenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | ≤ 10.0.1 | |
| Medium | 5.4 | CVE-2023-23993 | IP Blocker LiteCross-Site Request Forgery | ≤ 11.1.1 | |
| Medium | 5.4 | CVE-2023-28747 | CBX Currency ConverterCross-Site Request Forgery leading to Plugin Settings Leakage/Changes | ≤ 3.0.3 | |
| Medium | 5.4 | CVE-2023-28419 | Force First and Last Name as Display NameCross-Site Request Forgery | ≤ 1.2 | |
| Medium | 5.4 | CVE-2023-27430 | Mass Delete Unused TagsCross-Site Request Forgery via plugin_mass_delete_unused_tags_init | ≤ 2.0.0 | |
| Medium | 5.4 | CVE-2023-27423 | Auto Prune PostsCross-Site Request Forgery via admin_menu | ≤ 1.8.0 | |
| Medium | 5.4 | CVE-2023-26535 | Sheets To WP Table Live SyncCross-Site Request Forgery | ≤ 2.12.15 | |
| Medium | 5.4 | CVE-2023-26542 | phpinfo() WPCross-Site Request Forgery | ≤ 4.0 | |
| Medium | 5.4 | CVE-2023-24007 | Admin Block CountryCross-Site Request Forgery via admin_block_country_initial_page | ≤ 7.1.4 | |
| Medium | 5.4 | CVE-2023-23797 | Auto YouTube ImporterCross-Site Request Forgery | ≤ 1.0.3 | |
| Medium | 5.4 | CVE-2022-47609 | DNUICross-Site Request Forgery leading to Unused Image Deletion and Database Image Access | ≤ 2.8.1 | |
| Medium | 5.4 | CVE-2022-38061 | Export Post InfoAuthenticated (Author+) CSV Injection | ≤ 1.2.0 | |
| Medium | 5.3 | CVE-2025-22657 | AtarimMissing Authorization to Unauthenticated Arbitrary Post Deletion | ≤ 4.0.9 | |
| Medium | 5.3 | CVE-2025-47634 | WC Pickup StoreMissing Authorization to Unauthenticated Settings Update | ≤ 1.8.9 | |
| Medium | 5.3 | CVE-2025-49431 | MF Plus WPMLMissing Authorization to Unauthenticated Settings Update | ≤ 1.1 | |
| Medium | 5.3 | CVE-2025-53304 | Contact Form – 7 : Hide Success MessageMissing Authorization | ≤ 1.1.4 | |
| Medium | 5.3 | CVE-2025-52802 | Import YouTube videos as WP PostsMissing Authorization | ≤ 2.1 | |
| Medium | 5.3 | CVE-2025-49988 | Contact Form 7 AWeber ExtensionMissing Authorization | ≤ 0.1.42 | |
| Medium | 5.3 | CVE-2025-50008 | WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easilyMissing Authorization | ≤ 1.2.4.5 | |
| Medium | 5.3 | CVE-2025-49270 | WP-CRM SystemMissing Authorization | ≤ 3.4.2 | |
| Medium | 5.3 | CVE-2025-49268 | Verge3DMissing Authorization | ≤ 4.9.4 | |
| Medium | 5.3 | CVE-2025-47580 | Front End UsersMissing Authorization to Information Exposure | ≤ 3.2.32 | |
| Medium | 5.3 | CVE-2025-47450 | Simple File ListMissing Authorization to Unauthenticated Minor Settings Update | ≤ 6.1.13 | |
| Medium | 5.3 | CVE-2025-39554 | AI Text to SpeechMissing Authorization | ≤ 3.0.3 | |
| Medium | 5.3 | CVE-2025-39602 | WooCommerce Product Table LiteMissing Authorization | ≤ 3.9.5 | |
| Medium | 5.3 | CVE-2025-39553 | Church AdminUnauthenticated Information Disclosure | ≤ 5.0.9 | |
| Medium | 5.3 | CVE-2025-32544 | WooCommerce Loyal CustomersMissing Authorization | ≤ 2.6 | |
| Medium | 5.3 | CVE-2025-32593 | Add Product Frontend for WooCommerceMissing Authorization to Unauthenticated Arbitrary Content Deletion | ≤ 1.0.8 | |
| Medium | 5.3 | CVE-2025-32594 | Simple WP EventsUnauthenticated Sensitive Information Exposure | ≤ 1.8.17 | |
| Medium | 5.3 | CVE-2025-32244 | SEO HelpMissing Authorization | ≤ 6.8.5 | |
| Medium | 5.3 | CVE-2025-32243 | Internal Link OptimiserMissing Authorization to Unauthenticated Settings Update | ≤ 5.1.2 | |
| Medium | 5.3 | CVE-2025-32251 | Jetpack Feedback ExporterUnauthenticated Sensitive Information Exposure | ≤ 1.23 | |
| Medium | 5.3 | CVE-2025-32256 | SurveyJSMissing Authorization | ≤ 1.12.20 | |
| Medium | 5.3 | CVE-2025-32258 | Simple Website LogoMissing Authorization | ≤ 1.1 | |
| Medium | 5.3 | CVE-2025-32260 | DethemeKit For ElementorMissing Authorization | ≤ 2.1.10 | |
| Medium | 5.3 | CVE-2025-30915 | Small Package Quotes – Worldwide Express EditionMissing Authorization | ≤ 5.2.19 | |
| Medium | 5.3 | CVE-2025-31876 | PaydayMissing Authorization | ≤ 3.3.13 | |
| Medium | 5.3 | CVE-2025-30916 | Residential Address DetectionMissing Authorization | ≤ 2.5.4 | |
| Medium | 5.3 | CVE-2025-31795 | Shopify to WooCommerce MigrationMissing Authorization to Unauthenticated Settings Update | ≤ 1.3.0 | |
| Medium | 5.3 | CVE-2025-31729 | WooTumblogMissing Authorization to Unauthenticated Content Injection | ≤ 2.1.4 | |
| Medium | 5.3 | CVE-2025-31848 | WordPress Adverts PluginMissing Authorization | ≤ 1.4 | |
| Medium | 5.3 | CVE-2025-31863 | Agency ToolkitMissing Authorization | ≤ 1.0.24 | |
| Medium | 5.3 | CVE-2025-31777 | Clockinator LiteMissing Authorization | ≤ 1.0.7 | |
| Medium | 5.3 | CVE-2025-31765 | GDPR Cookie NoticeMissing Authorization | ≤ 1.2.0 | |
| Medium | 5.3 | CVE-2025-31866 | ShipDepot for WooCommerceMissing Authorization | ≤ 1.2.19 | |
| Medium | 5.3 | CVE-2025-31773 | Ship Per ProductMissing Authorization | ≤ 2.1.0 | |
| Medium | 5.3 | CVE-2025-31781 | Gift Cards for WooCommerceMissing Authorization | ≤ 1.5.8 | |
| Medium | 5.3 | CVE-2025-31870 | WP AutoKeywordMissing Authorization to Arbitrary Content Deletion | ≤ 1.0 | |
| Medium | 5.3 | CVE-2025-31822 | WP Simple HTML SitemapMissing Authorization | ≤ 3.5 | |
| Medium | 5.3 | CVE-2025-31788 | AIO Performance Profiler, Monitor, Optimize, Compress & DebugUnauthenticated Sensitive Information Exposure | ≤ 1.2 | |
| Medium | 5.3 | CVE-2025-31618 | Connector to CiviCRM with CiviMcRestFaceMissing Authorization | ≤ 1.0.10 | |
| Medium | 5.3 | CVE-2025-31580 | Ni WooCommerce Product EnquiryMissing Authorization | ≤ 4.1.8 | |
| Medium | 5.3 | CVE-2025-26960 | Small Package Quotes – Unishippers EditionMissing Authorization | ≤ 2.4.9 | |
| Medium | 5.3 | CVE-2025-26764 | Distance Based Shipping CalculatorMissing Authorization to Unauthenticated Settings Update | ≤ 2.0.22 | |
| Medium | 5.3 | CVE-2025-22287 | LTL Freight Quotes – FreightQuote EditionMissing Authorization | ≤ 2.3.11 | |
| Medium | 5.3 | CVE-2025-22289 | LTL Freight Quotes – Unishippers EditionMissing Authorization | ≤ 2.5.8 | |
| Medium | 5.3 | CVE-2025-22291 | LTL Freight Quotes – Worldwide Express EditionMissing Authorization to Unauthenticated Arbitrary Content Deletion | ≤ 5.0.20 | |
| Medium | 5.3 | CVE-2025-22668 | Awesome Event BookingMissing Authorization | ≤ 2.7.2 | |
| Medium | 5.3 | CVE-2025-24697 | Image Gallery – Responsive Photo GalleryMissing Authorization | ≤ 1.0.5 | |
| Medium | 5.3 | CVE-2024-52500 | Monetag Official PluginMissing Authorization | ≤ 1.1.3 | |
| Medium | 5.3 | CVE-2025-24633 | Build Private Store For WoocommerceMissing Authorization | ≤ 1.0 | |
| Medium | 5.3 | CVE-2025-24588 | Patreon WordPressMissing Authorization | ≤ 1.9.1 | |
| Medium | 5.3 | CVE-2025-24600 | RSVPMarkerMissing Authorization | ≤ 11.4.5 | |
| Medium | 5.3 | CVE-2025-24596 | WooCommerce Product Table LiteMissing Authorization | ≤ 3.8.7 | |
| Medium | 5.3 | CVE-2025-24582 | 12 Step Meeting ListUnauthenticated Sensitive Information Exposure | ≤ 3.16.5 | |
| Medium | 5.3 | CVE-2025-24705 | WooCommerce Quick ViewUnauthenticated Information Disclosure | ≤ 1.1.1 | |
| Medium | 5.3 | CVE-2025-22265 | EMI CalculatorMissing Authorization to Unauthenticated Settings Change | ≤ 1.1 | |
| Medium | 5.3 | CVE-2025-23766 | OPSI Israel Domestic ShipmentsMissing Authorization | ≤ 2.9.1.2 | |
| Medium | 5.3 | CVE-2025-23771 | Push Notification for Post and BuddyPressMissing Authorization to Unauthenticated Settings Update | ≤ 2.11 | |
| Medium | 5.3 | CVE-2025-23773 | Delete All PostsMissing Authorization | ≤ 1.1.1 | |
| Medium | 5.3 | CVE-2025-23512 | Team 118GROUP AgentMissing Authorization to Unauthenticated Arbitrary Content Deletion | ≤ 1.6.0 | |
| Medium | 5.3 | CVE-2025-23862 | Contact Form 7 Anti SpambotMissing Authorization | ≤ 1.0.1 | |
| Medium | 5.3 | CVE-2025-23764 | Copy Move PostsMissing Authorization | ≤ 1.6 | |
| Medium | 5.3 | CVE-2025-23514 | LoginplusMissing Authorization | ≤ 1.2 | |
| Medium | 5.3 | CVE-2025-23781 | WM Options Import ExportUnauthenticated Information Exposure | ≤ 1.0.1 | |
| Medium | 5.3 | CVE-2025-23774 | WPDB to SqlUnauthenticated Sensitive Information Exposure | ≤ 1.2 | |
| Medium | 5.3 | CVE-2025-22717 | My TicketsMissing Authorization | ≤ 2.0.9 | |
| Medium | 5.3 | CVE-2025-22720 | Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment plugin for WordPressMissing Authorization | ≤ 2.2.1 | |
| Medium | 5.3 | CVE-2025-22730 | KsherMissing Authorization | ≤ 1.1.2 | |
| Medium | 5.3 | CVE-2025-24642 | Setup Default Featured ImageMissing Authorization | ≤ 1.2 | |
| Medium | 5.3 | CVE-2025-22592 | 1003 Mortgage ApplicationMissing Authorization | ≤ 1.87 | |
| Medium | 5.3 | CVE-2025-22560 | Saoshyant Page BuilderMissing Authorization | ≤ 3.8 | |
| Medium | 5.3 | CVE-2025-22363 | Allada T-shirt Designer for WoocommerceMissing Authorization | ≤ 1.1 | |
| Medium | 5.3 | CVE-2024-56270 | WP SecureSubmitUnauthenticated Sensitive Information Exposure | ≤ 1.5.18 | |
| Medium | 5.3 | CVE-2025-22318 | Standard Box Sizes – for WooCommerceMissing Authorization | ≤ 1.6.13 | |
| Medium | 5.3 | CVE-2024-56238 | Floating Action ButtonsMissing Authorization | ≤ 0.9.1 | |
| Medium | 5.3 | CVE-2025-24581 | InstantioMissing Authorization to Unauthenticated Settings Update | ≤ 3.3.7 | |
| Medium | 5.3 | CVE-2024-55993 | Job Board ManagerMissing Authorization | ≤ 2.1.60 | |
| Medium | 5.3 | CVE-2024-55996 | Dreamfox Media Payment gateway per Product for WoocommerceMissing Authorization | ≤ 3.5.8 | |
| Medium | 5.3 | CVE-2024-55999 | XML Multilanguage Sitemap GeneratorMissing Authorization | ≤ 2.0.6 | |
| Medium | 5.3 | CVE-2024-56001 | KsherMissing Authorization | ≤ 1.1.1 | |
| Medium | 5.3 | CVE-2024-55997 | Order Delivery & Pickup Location Date Time ( Free Version )Missing Authorization to Unauthenticated Settings Update | ≤ 1.1.0 | |
| Medium | 5.3 | CVE-2024-54310 | Gou Manage My Account MenuMissing Authorization | ≤ 1.0.1.8 | |
| Medium | 5.3 | CVE-2025-24567 | WP MailsterUnauthenticated Sensitive Information Exposure | ≤ 1.8.16.0 | |
| Medium | 5.3 | CVE-2024-53795 | Church AdminMissing Authorization | ≤ 5.0.8 | |
| Medium | 5.3 | CVE-2024-53804 | WP MailsterUnauthenticated Information Exposure | ≤ 1.8.16.0 | |
| Medium | 5.3 | CVE-2024-52383 | Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in OneMissing Authorization | ≤ 2.1.2 | |
| Medium | 5.3 | CVE-2024-52395 | Floating Buttons for WooCommerceMissing Authorization | ≤ 2.8.8 | |
| Medium | 5.3 | CVE-2024-47321 | WP DatepickerMissing Authorization | ≤ 2.1.1 | |
| Medium | 5.3 | CVE-2024-8658 | myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for GamificationMissing Authorization to Unauthenticated Database Upgrade | ≤ 2.7.3 | |
| Medium | 5.3 | CVE-2024-43214 | myCredUnauthenticated Information Exposure | ≤ 2.7.2 | |
| Medium | 5.3 | CVE-2024-38745 | Wholesale SuiteMissing Authorization | ≤ 2.1.12 | |
| Medium | 5.3 | CVE-2024-37926 | WP Accessibility Helper (WAH)Missing Authorization | ≤ 0.6.2.9 | |
| Medium | 5.3 | CVE-2024-35683 | LeykaMissing Authorization | ≤ 3.31.1 | |
| Medium | 5.3 | CVE-2024-35692 | GDPR/CCPA Cookie Consent BannerMissing Authorization via handle_consent_toggle() | ≤ 3.2 | |
| Medium | 5.3 | CVE-2024-35749 | Under Construction / Maintenance Mode from AcuraxUnauthenticated IP Spoofing | ≤ 2.6 | |
| Medium | 5.3 | CVE-2024-35665 | Insert Post AdsMissing Authorization | ≤ 1.3.2 | |
| Medium | 5.3 | CVE-2024-32820 | Social Share Icons & Social Share ButtonsMissing Authorization to Notice Dismissal | ≤ 3.6.2 | |
| Medium | 5.3 | CVE-2024-33917 | WTI Like PostIP Spoofing | ≤ 1.4.6 | |
| Medium | 5.3 | CVE-2024-33931 | JW Player for WordPressMissing Authorization | ≤ 2.3.3 | |
| Medium | 5.3 | CVE-2024-33919 | RomethemeKit For ElementorMissing Authorization | ≤ 1.4.1 | |
| Medium | 5.3 | CVE-2024-33587 | Secure Copy Content Protection and Content LockingMissing Authorization | ≤ 3.9.0 | |
| Medium | 5.3 | CVE-2024-33597 | SSUMissing Authorization | ≤ 1.5.0 | |
| Medium | 5.3 | CVE-2024-32776 | AppPresserMissing Authorization | ≤ 4.3.0 | |
| Medium | 5.3 | CVE-2024-32799 | Easy Property ListingsMissing Authorization via epl_update_listing_coordinates() | ≤ 3.5.3 | |
| Medium | 5.3 | CVE-2024-32826 | VK Block PatternsMissing Authorization | ≤ 1.31.0 | |
| Medium | 5.3 | CVE-2024-32719 | WP Club ManagerMissing Authorization | ≤ 2.2.11 | |
| Medium | 5.3 | CVE-2024-31352 | Email Subscribers & NewslettersMissing Authorization | ≤ 5.7.13 | |
| Medium | 5.3 | CVE-2024-31274 | EmbedPressMissing Authorization | ≤ 3.9.11 | |
| Medium | 5.3 | CVE-2024-31230 | ShortPixel Adaptive ImagesMissing Authorization in activate_ai_handler and deactivate_ai_handler | ≤ 3.8.2 | |
| Medium | 5.3 | CVE-2024-30538 | DELUCKS SEOMissing Authorization | ≤ 2.5.4 | |
| Medium | 5.3 | CVE-2024-30525 | Move Addons for ElementorMissing Authorization | ≤ 1.2.9 | |
| Medium | 5.3 | CVE-2024-30477 | Klarna Payments for WooCommerceMissing Authorization | ≤ 3.2.4 | |
| Medium | 5.3 | CVE-2024-30480 | CGC Maintenance ModeIP Spoofing | ≤ 1.2 | |
| Medium | 5.3 | CVE-2024-30479 | IP Blocker LiteIP Spoofing | ≤ 11.1.1 | |
| Medium | 5.3 | CVE-2024-30522 | NewsletterIP Spoofing | ≤ 8.2.0 | |
| Medium | 5.3 | CVE-2024-24835 | BEARMissing Authorization via Several Functions | ≤ 1.1.4 | |
| Medium | 5.3 | CVE-2024-23519 | Email Before DownloadCross-Site Request Forgery | ≤ 6.9.7 | |
| Medium | 5.3 | CVE-2024-22294 | IP2Location Country BlockerUnauthenticated Sensitive Information Exposure via Debug Log File | ≤ 2.33.3 | |
| Medium | 5.3 | CVE-2024-21746 | Wp Ultimate ReviewIP Spoofing | ≤ 2.3.6 | |
| Medium | 5.3 | CVE-2023-52210 | Product Delivery Date for WooCommerce – LiteMissing Authorization | ≤ 2.7.0 | |
| Medium | 5.3 | CVE-2023-52126 | Send Users EmailSensitive Information Exposure via Error Logs | ≤ 1.4.3 | |
| Medium | 5.3 | CVE-2023-51357 | Conversios.ioMissing Authorization | ≤ 6.5.0 | |
| Medium | 5.3 | CVE-2023-49818 | Webflow PagesMissing Authorization | ≤ 1.0.8 | |
| Medium | 5.3 | CVE-2023-49762 | AppMySiteUnauthenticated Information Disclsoure | ≤ 3.11.0 | |
| Medium | 5.3 | CVE-2023-49194 | ImportifyUnauthenticated Sensitive Information Exposure | ≤ 1.0.4 | |
| Medium | 5.3 | CVE-2023-49741 | Coming soon and Maintenance modeIP Address Spoofing via get_real_ip | ≤ 3.7.3 | |
| Medium | 5.3 | CVE-2023-48753 | Restricted Site AccessIP Spoofing to Protection Mechanism Bypass | ≤ 7.4.1 | |
| Medium | 5.3 | CVE-2023-41134 | Antispam BeeIP Address Spoofing via get_client_ip | ≤ 2.11.3 | |
| Medium | 5.3 | CVE-2023-48271 | Maspik – Spam blacklistBypass | ≤ 0.10.3 | |
| Medium | 5.3 | CVE-2023-47832 | SearchIQMissing Authorization via getSIQPluginSettings | ≤ 4.4 | |
| Medium | 5.3 | CVE-2023-47769 | WP MaintenanceIP Restriction Bypass | ≤ 6.1.3 | |
| Medium | 5.3 | CVE-2023-40600 | EWWW Image OptimizerUnauthenticated Sensitive Information Exposure via Debug Log | ≤ 7.2.0 | |
| Medium | 5.3 | CVE-2023-47241 | CoCart – Headless ecommerceMissing Authorization | ≤ 3.11.2 | |
| Medium | 5.3 | CVE-2023-47244 | Email Marketing for WooCommerce by OmnisendSensitive Information Exposure | ≤ 1.13.8 | |
| Medium | 5.3 | CVE-2023-46605 | Convertful – Your Ultimate On-Site Conversion ToolMissing Authorization via add_woo_coupon | ≤ 2.5 | |
| Medium | 5.3 | CVE-2023-46609 | FeedFocalMissing Authorization via feedfocal_api_setup REST function | ≤ 1.2.2 | |
| Medium | 5.3 | CVE-2023-46606 | AtomChatMissing Authorization via credits REST API Endpoint | ≤ 1.1.4 | |
| Medium | 5.3 | CVE-2023-44993 | ChatBotCross-Site Request Forgery via qc_wp_latest_update_check | ≤ 4.7.8 | |
| Medium | 5.3 | CVE-2023-41803 | BitPay Checkout for WooCommerceMissing Authorization | ≤ 4.1.0 | |
| Medium | 5.3 | CVE-2023-41133 | Secure Admin IPMissing Authorization via 'saveSettings' | ≤ 2.0 | |
| Medium | 5.3 | CVE-2023-40662 | Cookies and Content Security PolicySensitive Information Exposure | ≤ 2.15 | |
| Medium | 5.3 | CVE-2023-40332 | WP-PostRatingsIP Spoofing | ≤ 1.91 | |
| Medium | 5.3 | CVE-2023-35040 | SendPress NewslettersMissing Authorization | ≤ 1.23.11.6 | |
| Medium | 5.3 | CVE-2023-36528 | kk Star RatingsIP Spoofing to Protection Mechanism Bypass | ≤ 5.4.3 | |
| Medium | 5.3 | CVE-2023-37972 | WooCommerce Product Stock AlertInformation Disclosure | ≤ 2.0.1 | |
| Medium | 5.3 | CVE-2023-35875 | GutenverseMissing Authorization via 'data/update' API Endpoint | ≤ 1.8.5 | |
| Medium | 5.3 | CVE-2023-32963 | WooCommerce Predictive SearchMissing Authorization via multiple AJAX actions | ≤ 5.8.0 | |
| Medium | 5.1 | CVE-2022-42882 | Simple CSV/XLS ExporterCSV Injection | ≤ 1.5.8 | |
| Medium | 4.9 | CVE-2023-23872 | GMAceAuthenticated(Admin+) Directory Traversal | ≤ 1.5.2 | |
| Medium | 4.8 | CVE-2022-46802 | Product Reviews Import Export for WooCommerceCSV Injection | ≤ 1.4.8 | |
| Medium | 4.8 | CVE-2022-0969 | Image optimization & Lazy LoadAdmin+ Stored Cross-Site Scripting | ≤ 3.3.1 | |
| Medium | 4.8 | CVE-2022-0535 | E2PdfStored Cross-Site Scripting | ≤ 1.16.44 | |
| Medium | 4.8 | CVE-2021-24811 | Shop Page WPAuthenticated Cross-Site Scripting | ≤ 1.2.7 | |
| Medium | 4.8 | CVE-2021-24856 | Shared Files – Easy Download Manager and File Sharing Plugin with Frontend File UploadCross-Site Scripting | ≤ 1.6.60 | |
| Medium | 4.4 | CVE-2024-44042 | WP DatepickerAuthenticated (Administrator+) Stored Cross-Site Scripting | ≤ 2.1.1 | |
| Medium | 4.4 | CVE-2024-31925 | F4 ImprovementsAuthenticated (Admin+) Stored Cross-Site Scripting | ≤ 1.8.0 | |
| Medium | 4.4 | CVE-2024-31089 | Platinum SEOAuthenticated (Administrator+) Stored Cross-Site Scripting | ≤ 2.4.0 | |
| Medium | 4.4 | CVE-2024-22153 | Stock Locations for WooCommerceAuthenticated (Administrator+) Stored Cross-Site Scripting via settings | ≤ 2.5.9 | |
| Medium | 4.4 | CVE-2023-51548 | SlickNav Mobile MenuAuthenticated (Admin+) Stored Cross-Site Scripting | ≤ 1.9.2 | |
| Medium | 4.4 | CVE-2023-49770 | Smart External Link Click Monitor [Link Log]Authenticated (Administrator+) Stored Cross-Site Scripting | ≤ 5.0.2 | |
| Medium | 4.4 | CVE-2023-47245 | ANAC XML ViewerAuthenticated (Administrator+) Stored Cross-Site Scripting | ≤ 1.7 | |
| Medium | 4.4 | CVE-2023-32580 | Password ProtectedAuthenticated (Administrator+) Stored Cross-Site Scripting | ≤ 2.6.2 | |
| Medium | 4.4 | CVE-2023-32578 | Column-MaticAuthenticated (Contributor+) Stored Cross-Site Scripting | ≤ 1.3.3 | |
| Medium | 4.4 | CVE-2022-47607 | UsersnapAuthenticated (Admin+) Stored Cross Site Scripting | ≤ 4.16 | |
| Medium | 4.4 | CVE-2022-47610 | Simple Image PopupAuthenticated (Admin+) Stored Cross-Site Scripting | ≤ 1.3.6 | |
| Medium | 4.4 | CVE-2023-23793 | Read More Without RefreshAuthenticated (Administrator+) Stored Cross-Site Scripting | ≤ 3.1 | |
| Medium | 4.3 | CVE-2025-15635 | Smart Online Order for CloverCross-Site Request Forgery | ≤ 1.6.4 | |
| Medium | 4.3 | CVE-2025-64271 | Plugin ManagerCross-Site Request Forgery | ≤ 1.4.7 | |
| Medium | 4.3 | CVE-2025-67559 | Online Booking & Scheduling Calendar for WordPress by vcitaMissing Authorization | ≤ 4.5.5 | |
| Medium | 4.3 | CVE-2025-67472 | Online Booking & Scheduling Calendar for WordPress by vcitaCross-Site Request Forgery | ≤ 4.5.5 | |
| Medium | 4.3 | CVE-2025-58255 | Custom Post Type ImagesCross-Site Request Forgery | ≤ 0.5 | |
| Medium | 4.3 | CVE-2025-58869 | SimaCookieCross-Site Request Forgery | ≤ 1.3.2 | |
| Medium | 4.3 | CVE-2025-58878 | Woocommerce Gifts ProductCross-Site Request Forgery | ≤ 1.0.0 | |
| Medium | 4.3 | CVE-2025-48318 | 多说社会化评论框Cross-Site Request Forgery to Settings Update | ≤ 1.2 | |
| Medium | 4.3 | CVE-2025-54732 | WPDM – Premium PackagesCross-Site Request Forgery | ≤ 6.0.2 | |
| Medium | 4.3 | CVE-2025-49052 | Netease MusicMissing Authorization | ≤ 3.2.1 | |
| Medium | 4.3 | CVE-2025-48167 | Chatbox ManagerMissing Authorization | ≤ 1.2.5 | |
| Medium | 4.3 | CVE-2025-48150 | Real Estate Property 2024 Create Your Own Fields and Search Bar WP PluginMissing Authorization | ≤ 4.48 | |
| Medium | 4.3 | CVE-2025-49373 | Evergreen Content PosterCross-Site Request Forgery | ≤ 1.4.5 | |
| Medium | 4.3 | CVE-2025-53569 | Trust Payments Gateway for WooCommerce (JavaScript Library)Cross-Site Request Forgery | ≤ 1.3.6 | |
| Medium | 4.3 | CVE-2025-3702 | Melapress File Monitor < 2.2.0 - Missing Authorization | — | |
| Medium | 4.3 | CVE-2025-54045 | CM On Demand Search And ReplaceMissing Authorization | ≤ 1.5.4 | |
| Medium | 4.3 | CVE-2025-53293 | Dashboard Widget SidebarMissing Authorization | ≤ 1.2.3 | |
| Medium | 4.3 | CVE-2025-53261 | WP YouTube LiveCross-Site Request Forgery | ≤ 1.10.0 | |
| Medium | 4.3 | CVE-2025-49971 | eDS Responsive MenuMissing Authorization | ≤ 1.2 | |
| Medium | 4.3 | CVE-2025-50036 | Mailing Group ListservCross-Site Request Forgery | ≤ 3.0.5 | |
| Medium | 4.3 | CVE-2025-50044 | Real Estate ManagerCross-Site Request Forgery | ≤ 7.3 | |
| Medium | 4.3 | CVE-2025-52795 | WP Front User Submit / Front EditorCross-Site Request Forgery | ≤ 4.9.4 | |
| Medium | 4.3 | CVE-2025-49969 | Zara 4 Image CompressionMissing Authorization | ≤ 1.2.17.2 | |
| Medium | 4.3 | CVE-2025-49998 | WooCommerce Fortnox IntegrationMissing Authorization | ≤ 4.5.5 | |
| Medium | 4.3 | CVE-2025-49234 | WP Dummy Content GeneratorMissing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion | ≤ 3.4.6 | |
| Medium | 4.3 | CVE-2025-49865 | Advanced SettingsCross-Site Request Forgery | ≤ 3.0.1 | |
| Medium | 4.3 | CVE-2025-49880 | CubeWP FormsMissing Authorization | ≤ 1.1.5 | |
| Medium | 4.3 | CVE-2025-49510 | Min Max Step Quantity Limits Manager for WooCommerceCross-Site Request Forgery | ≤ 5.1.0 | |
| Medium | 4.3 | CVE-2025-49269 | Market ExporterCross-Site Request Forgery | ≤ 2.0.22 | |
| Medium | 4.3 | CVE-2025-48334 | Woo Slider ProMissing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion | ≤ 1.12 | |
| Medium | 4.3 | CVE-2025-47451 | Product Quantity Dropdown For WoocommerceCross-Site Request Forgery | ≤ 1.2 | |
| Medium | 4.3 | CVE-2025-39456 | WP LoggerMissing Authorization | ≤ 2.2 | |
| Medium | 4.3 | CVE-2025-32929 | Barcode Generator for WooCommerceAuthenticated (Subscriber+) Arbitrary Content Deletion | ≤ 2.0.4 | |
| Medium | 4.3 | CVE-2025-32279 | Contact Form, Drag and Drop Form Builder PluginMissing Authorization | ≤ 4.8.5 | |
| Medium | 4.3 | CVE-2025-32236 | Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products VagonicMissing Authorization | ≤ 1.9 | |
| Medium | 4.3 | CVE-2025-32234 | AdMail – Multilingual Back in-Stock Notifier for WooCommerceMissing Authorization | ≤ 1.7.0 | |
| Medium | 4.3 | CVE-2025-32219 | eaSYNCMissing Authorization | ≤ 1.3.19 | |
| Medium | 4.3 | CVE-2025-32237 | MasterStudy LMSMissing Authorization | ≤ 3.5.28 | |
| Medium | 4.3 | CVE-2025-32278 | Table Block by RioVizualCross-Site Request Forgery | ≤ 2.3.1 | |
| Medium | 4.3 | CVE-2025-31758 | Free Woocommerce Product Table ViewMissing Authorization to Arbitrary Content Deletion | ≤ 1.78 | |
| Medium | 4.3 | CVE-2025-31746 | ClientsMissing Authorization | ≤ 1.1.4 | |
| Medium | 4.3 | CVE-2025-31739 | Minimalistic Event ManagerMissing Authorization | ≤ 1.1.1 | |
| Medium | 4.3 | CVE-2025-31794 | WR Price List Manager For WoocommerceMissing Authorization to Arbitrary Content Deletion | ≤ 1.0.8 | |
| Medium | 4.3 | CVE-2025-31757 | Free Woocommerce Product Table ViewMissing Authorization | ≤ 1.78 | |
| Medium | 4.3 | CVE-2025-31732 | GB Gallery SlideshowMissing Authorization | ≤ 1.3 | |
| Medium | 4.3 | CVE-2025-31843 | OpenAI Tools for WordPress & WooCommerceMissing Authorization | ≤ 2.1.5 | |
| Medium | 4.3 | CVE-2025-31755 | pCloud BackupMissing Authorization | ≤ 1.0.1 | |
| Medium | 4.3 | CVE-2025-31881 | PearlMissing Authorization | ≤ 1.3.9 | |
| Medium | 4.3 | CVE-2025-31880 | PearlCross-Site Request Forgery | ≤ 1.3.9 | |
| Medium | 4.3 | CVE-2025-31780 | Append ContentCross-Site Request Forgery to Settings Update | ≤ 2.1.1 | |
| Medium | 4.3 | CVE-2025-31852 | Bulk Product SyncCross-Site Request Forgery | ≤ 8.6 | |
| Medium | 4.3 | CVE-2025-31887 | MyBookProgress by Stormhill MediaMissing Authorization | ≤ 1.0.8 | |
| Medium | 4.3 | CVE-2025-31879 | Barcode Generator for WooCommerceMissing Authorization to Authenticated (Subscriber+) Settings Update | ≤ 2.0.4 | |
| Medium | 4.3 | CVE-2025-31802 | Shiptimize for WooCommerceMissing Authorization to Authenticated (Subscriber+) Settings Update | ≤ 3.1.86 | |
| Medium | 4.3 | CVE-2025-31878 | UPC/EAN/GTIN Code GeneratorMissing Authorization to Authenticated (Subscriber+) Settings Update | ≤ 2.0.2 | |
| Medium | 4.3 | CVE-2025-31611 | Auto Post After Image UploadMissing Authorization | ≤ 1.6 | |
| Medium | 4.3 | CVE-2025-31596 | Chat by ChatweeMissing Authorization | ≤ 2.1.3 | |
| Medium | 4.3 | CVE-2025-31576 | PostmarkApp Email IntegratorMissing Authorization | ≤ 2.4 | |
| Medium | 4.3 | CVE-2025-31603 | CF7 SpreadsheetsMissing Authorization to Settings Update | ≤ 2.3.2 | |
| Medium | 4.3 | CVE-2025-31376 | NanoSupportMissing Authorization | ≤ 0.6.0 | |
| Medium | 4.3 | CVE-2025-30923 | Gift Message for WooCommerceCross-Site Request Forgery | ≤ 1.7.8 | |
| Medium | 4.3 | CVE-2025-1314 | Custom Twitter FeedsCross-Site Request Forgery to Cache Reset via ctf_clear_cache_admin Function | ≤ 2.2.5 | |
| Medium | 4.3 | CVE-2025-27276 | Photo Gallery ( Responsive )Cross-Site Request Forgery to Privilege Escalation | ≤ 4.0 | |
| Medium | 4.3 | CVE-2025-23515 | ts-treeMissing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion | ≤ 0.1.1 | |
| Medium | 4.3 | CVE-2025-26765 | Distance Based Shipping CalculatorMissing Authorization | ≤ 2.0.22 | |
| Medium | 4.3 | CVE-2024-12164 | WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet AddonMissing Authorization to Authenticated (Subscriber+) Settings Reset | ≤ 1.6 | |
| Medium | 4.3 | CVE-2025-22669 | Awesome Event BookingCross-Site Request Forgery | ≤ 2.7.5 | |
| Medium | 4.3 | CVE-2025-22671 | Disable Elementor Editor TranslationMissing Authorization | ≤ 1.0.2 | |
| Medium | 4.3 | CVE-2025-22667 | Export Order, Product, Customer & Coupon for WooCommerce to Google SheetsMissing Authorization | ≤ 1.8.2 | |
| Medium | 4.3 | CVE-2025-24571 | WP Fast Total SearchMissing Authorization | ≤ 1.78.258 | |
| Medium | 4.3 | CVE-2025-24594 | Linet ERP-Woocommerce IntegrationCross-Site Request Forgery | ≤ 3.5.7 | |
| Medium | 4.3 | CVE-2025-24572 | WP Fast Total SearchCross-Site Request Forgery | ≤ 1.78.258 | |
| Medium | 4.3 | CVE-2025-24693 | Advanced NotificationsMissing Authorization | ≤ 1.2.7 | |
| Medium | 4.3 | CVE-2025-24652 | WP Duplicate – WordPress Migration PluginMissing Authorization | ≤ 1.1.6 | |
| Medium | 4.3 | CVE-2025-24691 | People ListsMissing Authorization | ≤ 1.3.10 | |
| Medium | 4.3 | CVE-2025-24736 | Post DuplicatorMissing Authorization | ≤ 2.35 | |
| Medium | 4.3 | CVE-2025-24604 | VFormMissing Authorization | ≤ 3.0.5 | |
| Medium | 4.3 | CVE-2025-24625 | Taxonomy/Term and Role based Discounts for WooCommerceCross-Site Request Forgery to Settings Update | ≤ 5.1 | |
| Medium | 4.3 | CVE-2025-24647 | WooCommerce Cloak Affiliate LinksCross-Site Request Forgery | ≤ 1.0.35 | |
| Medium | 4.3 | CVE-2025-24580 | 12 Step Meeting ListMissing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion | ≤ 3.16.5 | |
| Medium | 4.3 | CVE-2025-23849 | PAPERCITEMissing Authorization | ≤ 0.5.18 | |
| Medium | 4.3 | CVE-2025-23534 | WPLingo – Forum PluginMissing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion | ≤ 1.1.2 | |
| Medium | 4.3 | CVE-2025-23613 | WP JournalMissing Authorization | ≤ 1.1 | |
| Medium | 4.3 | CVE-2025-23615 | Interactive Page HierarchyMissing Authorization | ≤ 1.0.1 | |
| Medium | 4.3 | CVE-2025-23763 | WAH FormsMissing Authorization | ≤ 1.0 | |
| Medium | 4.3 | CVE-2025-23785 | AI Responsive Gallery AlbumMissing Authorization | ≤ 1.4 | |
| Medium | 4.3 | CVE-2025-23684 | Debug ToolMissing Authorization | ≤ 2.2 | |
| Medium | 4.3 | CVE-2025-23962 | GoldstarMissing Authorization | ≤ 2.1.1 | |
| Medium | 4.3 | CVE-2025-23930 | PayPal Marketing SolutionsMissing Authorization | ≤ 1.2 | |
| Medium | 4.3 | CVE-2025-23778 | User Sync ActiveCampaignMissing Authorization | ≤ 1.3.2 | |
| Medium | 4.3 | CVE-2025-23954 | Salvador – AI Image GeneratorMissing Authorization | ≤ 1.0.11 | |
| Medium | 4.3 | CVE-2025-23776 | Cache Sniper for NginxMissing Authorization | ≤ 1.0.4.2 | |
| Medium | 4.3 | CVE-2025-23957 | Sur.lyMissing Authorization | ≤ 3.0.3 | |
| Medium | 4.3 | CVE-2025-23761 | Woo TunerMissing Authorization | ≤ 0.1.2 | |
| Medium | 4.3 | CVE-2025-23955 | XolaMissing Authorization | ≤ 1.6 | |
| Medium | 4.3 | CVE-2025-23916 | WP MeetupMissing Authorization to Authenticated (Subscriber+) Settings Update | ≤ 2.3.0 | |
| Medium | 4.3 | CVE-2025-22729 | VOD InfomaniakMissing Authorization | ≤ 1.5.9 | |
| Medium | 4.3 | CVE-2025-22779 | WP News SlidersMissing Authorization | ≤ 1.0 | |
| Medium | 4.3 | CVE-2025-22731 | Build Private Store For WoocommerceCross-Site Request Forgery | ≤ 1.0 | |
| Medium | 4.3 | CVE-2025-22591 | 1003 Mortgage ApplicationMissing Authorization | ≤ 1.87 | |
| Medium | 4.3 | CVE-2025-22541 | WP Delete Post CopiesMissing Authorization | ≤ 5.5 | |
| Medium | 4.3 | CVE-2025-22561 | Title Experiments FreeMissing Authorization | ≤ 9.0.4 | |
| Medium | 4.3 | CVE-2025-22562 | Title Experiments FreeCross-Site Request Forgery | ≤ 9.0.4 | |
| Medium | 4.3 | CVE-2025-22543 | ST Gallery WPMissing Authorization to Authenticated (Subscriber+) Settings Update | ≤ 1.0.8 | |
| Medium | 4.3 | CVE-2024-12327 | LazyLoad Background ImagesMissing Authorization to Authenticated (Subscriber+) Plugin Settings Update | ≤ 1.0.7 | |
| Medium | 4.3 | CVE-2024-56272 | Hide Category by User Role for WooCommerceMissing Authorization | ≤ 2.1.1 | |
| Medium | 4.3 | CVE-2024-56271 | WP SecureSubmitMissing Authorization | ≤ 1.5.18 | |
| Medium | 4.3 | CVE-2024-56244 | Ashe ExtraMissing Authorization | ≤ 1.2.92 | |
| Medium | 4.3 | CVE-2024-56215 | Member Directory and Contact FormMissing Authorization | ≤ 1.7.0 | |
| Medium | 4.3 | CVE-2024-56207 | EditionGuard for WooCommerce – eBook Sales with DRMCross-Site Request Forgery to Privilege Escalation | ≤ 3.4.2 | |
| Medium | 4.3 | CVE-2024-56031 | Smart Shopify ProductMissing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion | ≤ 1.0.2 | |
| Medium | 4.3 | CVE-2024-56007 | LeaderMissing Authorization | ≤ 2.6.1 | |
| Medium | 4.3 | CVE-2024-56003 | Caldera SMTP MailerMissing Authorization | ≤ 1.0.1 | |
| Medium | 4.3 | CVE-2024-55994 | 畅言评论系统Missing Authorization | ≤ 2.0.5 | |
| Medium | 4.3 | CVE-2024-56004 | Easy Site ImporterMissing Authorization to Authenticated (Subscriber+) Settings Change | ≤ 1.0.1 | |
| Medium | 4.3 | CVE-2024-55992 | WooCommerce Basic OrdernumbersMissing Authorization | ≤ 1.4.4 | |
| Medium | 4.3 | CVE-2024-54309 | PostBoxMissing Authorization to Authenticated (Subscriber+) Log Export | ≤ 1.0.4 | |
| Medium | 4.3 | CVE-2024-54271 | WPCargo Track & TraceMissing authorization to Authenticated (Subscriber+) Settings Update | ≤ 8.0.1 | |
| Medium | 4.3 | CVE-2024-11353 | SMS for Lead Capture FormsMissing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion | ≤ 1.1.0 | |
| Medium | 4.3 | CVE-2024-53799 | FloristPressMissing Authorization to Sensitive Data Exposure | ≤ 7.3.0 | |
| Medium | 4.3 | CVE-2024-53806 | Maspik – Spam blacklistCross-Site Request Forgery to Plugin Settings Change | ≤ 2.2.7 | |
| Medium | 4.3 | CVE-2024-11355 | Ultimate YouTube Video & Shorts Player With VimeoMissing Authorization to Authenticated (Subscriber+) Setting Exposure | ≤ 3.3 | |
| Medium | 4.3 | CVE-2024-11354 | Ultimate YouTube Video & Shorts Player With VimeoMissing Authorization to Authenticated (Subscriber+) Arbitrary Playlist/Video Deletion | ≤ 3.3 | |
| Medium | 4.3 | CVE-2024-51817 | Combo WP Rewrite SlugsMissing Authorization to Authenticated (Subscriber+) Settings Change | ≤ 1.0 | |
| Medium | 4.3 | CVE-2024-48031 | Featured Posts with Multiple Custom Groups (FPMCG)Cross-Site Request Forgery | ≤ 4.0 | |
| Medium | 4.3 | CVE-2024-47634 | CartBounty – Save and recover abandoned carts for WooCommerceCross-Site Request Forgery | ≤ 8.2 | |
| Medium | 4.3 | CVE-2024-33682 | WP GDPR ComplianceCross-Site Request Forgery | ≤ 2.0.23 | |
| Medium | 4.3 | CVE-2024-32106 | WP Compress – Image Optimizer [All-In-One]Cross-Site Request Forgery | ≤ 6.10.35 | |
| Medium | 4.3 | CVE-2024-32081 | Filter Custom Fields & Taxonomies LightMissing Authorization | ≤ 1.05 | |
| Medium | 4.3 | CVE-2024-31423 | WP Accessibility Helper (WAH)Missing Authorization | ≤ 0.6.2.5 | |
| Medium | 4.3 | CVE-2024-31374 | AppPresserCross-Site Request Forgery via force_logging_off() | ≤ 4.3.0 | |
| Medium | 4.3 | CVE-2024-31934 | Link Whisper Free <= 0.6.9 | — | |
| Medium | 4.3 | CVE-2024-25931 | HeurekaCross-Site Request Forgery | ≤ 1.0.8 | |
| Medium | 4.3 | CVE-2024-25906 | Comments Like DislikeIP Spoofing | ≤ 1.2.2 | |
| Medium | 4.3 | CVE-2024-22143 | WP Spell CheckCross-Site Request Forgery | ≤ 9.17 | |
| Medium | 4.3 | CVE-2024-31276 | Products & Order Export for WooCommerceMissing Authorization | ≤ 2.0.7 | |
| Medium | 4.3 | CVE-2023-50878 | MStore APICross-Site Request Forgery | ≤ 4.10.1 | |
| Medium | 4.3 | CVE-2023-50858 | Anti HackerCross-Site Request Forgery via antihacker_ajax_scan | ≤ 4.34 | |
| Medium | 4.3 | CVE-2023-50861 | HUSKY – Products Filter for WooCommerce (formerly WOOF)Cross-Site Request Forgery | ≤ 1.3.4.3 | |
| Medium | 4.3 | CVE-2023-49769 | Integrate Google DriveCross-Site Request Forgery | ≤ 1.3.4 | |
| Medium | 4.3 | CVE-2023-47765 | CodeBard's Patron Button and Widgets for PatreonCross-Site Request Forgery | ≤ 2.1.9 | |
| Medium | 4.3 | CVE-2023-47664 | Plainview Protect PasswordsCross-Site Request Forgery | ≤ 1.4 | |
| Medium | 4.3 | CVE-2023-46777 | Feather Login PageCross-Site Request Forgery | ≤ 1.1.3 | |
| Medium | 4.3 | CVE-2023-46638 | WCP OpenWeatherCross-Site Request Forgery | ≤ 2.5.0 | |
| Medium | 4.3 | CVE-2023-46190 | Novo-Map : your WP posts on custom google mapsCross-Site Request Forgery | ≤ 1.1.2 | |
| Medium | 4.3 | CVE-2023-45654 | Comments RatingsCross-Site Request Forgery | ≤ 1.1.7 | |
| Medium | 4.3 | CVE-2023-45656 | Lazy Load for VideosCross-Site Request Forgery | ≤ 2.18.2 | |
| Medium | 4.3 | CVE-2023-45655 | PixFieldsCross-Site Request Forgery | ≤ 0.7.0 | |
| Medium | 4.3 | CVE-2023-45752 | Post GalleryCross-Site Request Forgery | ≤ 2.3.12 | |
| Medium | 4.3 | CVE-2023-45653 | Video Playlist For YouTubeCross-Site Request Forgery | ≤ 6.1 | |
| Medium | 4.3 | CVE-2023-45650 | HTML5 MapsCross-Site Request Forgery | ≤ 1.7.1.4 | |
| Medium | 4.3 | CVE-2023-45267 | IRivYouCross-Site Request Forgery via saveOptionsReviewsPlugin | ≤ 2.2.1 | |
| Medium | 4.3 | CVE-2023-45102 | Blog Manager LightCross-Site Request Forgery via bml_settings | ≤ 1.20 | |
| Medium | 4.3 | CVE-2023-45107 | GoodBarberCross-Site Request Forgery via admin_options | ≤ 1.0.23 | |
| Medium | 4.3 | CVE-2023-45268 | Hitsteps Web AnalyticsCross-Site Request Forgery via hst_optionpage | ≤ 5.86 | |
| Medium | 4.3 | CVE-2023-45108 | MailrelayCross-Site Request Forgery via render_admin_page | ≤ 2.1.1 | |
| Medium | 4.3 | CVE-2023-45103 | Permalinks CustomizerCross-Site Request Forgery via post_settings | ≤ 2.8.2 | |
| Medium | 4.3 | CVE-2023-45274 | SendPulse Free Web PushCross-Site Request Forgery via sendpulse_config | ≤ 1.3.1 | |
| Medium | 4.3 | CVE-2023-45273 | Stout Google CalendarCross-Site Request Forgery via sgc_plugin_options | ≤ 1.2.3 | |
| Medium | 4.3 | CVE-2023-45109 | WhitePageCross-Site Request Forgery via params_api_form.php | ≤ 1.1.5 | |
| Medium | 4.3 | CVE-2023-45052 | WP Bing Map ProCross-Site Request Forgery via AJAX actions | ≤ 4.1.4 | |
| Medium | 4.3 | CVE-2023-44995 | WooCommerce Login RedirectCross-Site Request Forgery | ≤ 2.2.4 | |
| Medium | 4.3 | CVE-2023-44998 | Category MetaCross-Site Request Forgery | ≤ 1.2.8 | |
| Medium | 4.3 | CVE-2023-45060 | Interactive World MapCross-Site Request Forgery | ≤ 3.2.0 | |
| Medium | 4.3 | CVE-2023-45058 | Short URLCross-Site Request Forgery | ≤ 1.6.8 | |
| Medium | 4.3 | CVE-2023-41801 | AWP ClassifiedsCross-Site Request Forgery | ≤ 4.3 | |
| Medium | 4.3 | CVE-2023-41853 | WP iCal AvailabilityCross-Site Request Forgery | ≤ 1.0.3 | |
| Medium | 4.3 | CVE-2023-41684 | SIS HandballCross-Site Request Forgery | ≤ 1.0.45 | |
| Medium | 4.3 | CVE-2023-41694 | RealbigCross-Site Request Forgery | ≤ 1.0.6 | |
| Medium | 4.3 | CVE-2023-27433 | Make Paths RelativeCross-Site Request Forgery via 'admin/class-make-paths-relative-admin.php' | ≤ 1.3.0 | |
| Medium | 4.3 | CVE-2023-40212 | WooCommerce Product AttachmentCross-Site Request Forgery | ≤ 2.1.8 | |
| Medium | 4.3 | CVE-2023-39159 | Woocommerce Blocker LiteCross-Site Request Forgery | ≤ 2.1.5 | |
| Medium | 4.3 | CVE-2023-24380 | Simple Wp SitemapCross-Site Request Forgery | ≤ 1.2.1 | |
| Medium | 4.3 | CVE-2023-25489 | Update Theme and Plugins from Zip FileCross-Site Request Forgery | ≤ 2.0.0 | |
| Medium | 4.3 | CVE-2023-39158 | Woocommerce Category Banner ManagementCross-Site Request Forgery | ≤ 2.4.1 | |
| Medium | 4.3 | CVE-2023-25980 | Optimize Database after Deleting RevisionsCross-Site Request Forgery via 'odb_start_manually' | ≤ 5.1.1 | |
| Medium | 4.3 | CVE-2023-25025 | WP-CopyProtect [Protect your blog posts]Cross-Site Request Forgery via CopyProtect_options_page | ≤ 3.1.0 | |
| Medium | 4.3 | CVE-2023-37889 | WPAdmin AWS CDNCross-Site Request Forgery | ≤ 2.0.13 | |
| Medium | 4.3 | CVE-2023-25036 | Social Media Icons WidgetCross-Site Request Forgery | ≤ 1.6 | |
| Medium | 4.3 | CVE-2023-35089 | Recipe Maker For Your Food Blog from Zip RecipesCross-Site Request Forgery | ≤ 8.0.7 | |
| Medium | 4.3 | CVE-2023-35038 | WP PDF GeneratorCross-Site Request Forgery to PDF Settings Update | ≤ 1.2.2 | |
| Medium | 4.3 | CVE-2023-34002 | WP Inventory ManagerCross-Site Request Forgery via delete_item | ≤ 2.1.0.13 | |
| Medium | 4.3 | CVE-2023-34020 | Uncanny Toolkit for LearnDashOpen Redirect | ≤ 3.6.4.3 | |
| Medium | 4.3 | CVE-2023-34171 | WP Report PostCross-Site Request Forgery | ≤ 2.1.2 | |
| Medium | 4.3 | CVE-2023-34182 | LH Password ChangerCross-Site Request Forgery | ≤ 1.55 | |
| Medium | 4.3 | CVE-2023-25473 | Flickr Justified GalleryCross-Site Request Forgery via fjgwpp_settings() | ≤ 3.5 | |
| Medium | 4.3 | CVE-2023-25482 | WP TilesCross-Site Request Forgery | ≤ 1.1.2 | |
| Medium | 4.3 | CVE-2023-32739 | WP Custom Cursors < 3.2 - Cross-Site Request Forgery | — | |
| Medium | 4.3 | CVE-2023-32514 | Google Site Verification plugin using Meta TagCross-Site Request Forgery | ≤ 1.2 | |
| Medium | 4.3 | CVE-2023-31089 | Video XML Sitemap GeneratorCross-Site Request Forgery via video_sitemap_generate | ≤ 1.0.0 | |
| Medium | 4.3 | CVE-2023-31093 | Chronosly Events CalendarCross-Site Request Forgery via plugin_settings_page | ≤ 2.6.2 | |
| Medium | 4.3 | CVE-2023-23646 | Album Gallery – WordPress GalleryCross-Site Request Forgery via album-gallery-column-settings.php | ≤ 1.4.9 | |
| Medium | 4.3 | CVE-2023-23997 | Database Collation FixCross-Site Request Forgery via admin_page | ≤ 1.2.7 | |
| Medium | 4.3 | CVE-2023-27606 | WP Reroute EmailCross-Site Request Forgery | ≤ 1.4.6 | |
| Medium | 4.3 | CVE-2023-25487 | PixTypesCross-Site Request Forgery | ≤ 1.4.14 | |
| Medium | 4.3 | CVE-2023-29433 | tencentcloud-cosMissing Authorization via AJAX actions | ≤ 1.0.7 | |
| Medium | 4.3 | CVE-2023-24421 | PHP Compatibility CheckerCross-Site Request Forgery | ≤ 1.5.2 | |
| Medium | 4.3 | CVE-2023-25051 | Comment Reply NotificationCross-Site Request Forgery | ≤ 1.4 | |
| Medium | 4.3 | CVE-2023-28987 | Wp Ultimate ReviewCross-Site Request Forgery | ≤ 2.0.3 | |
| Medium | 4.3 | CVE-2023-22694 | BigContactCross-Site Request Forgery leading to Plugin Settings Updates | ≤ 1.5.8 | |
| Medium | 4.3 | CVE-2023-25478 | Weather StationCross-Site Request Forgery | ≤ 3.8.11 | |
| Medium | 4.3 | CVE-2023-23869 | Google XML Sitemap for MobileCross-Site Request Forgery via mobile_sitemap_generate | ≤ 1.6.1 | |
| Medium | 4.3 | CVE-2023-23897 | Simple Mobile URL RedirectCross-Site Request Forgery leading to Mobile Redirect Updates | ≤ 1.7.2 | |
| Medium | 4.3 | CVE-2023-22673 | Website Monetization by MageNetCross-Site Request Forgery via admin_magenet_settings | ≤ 1.0.29.1 | |
| Medium | 4.3 | CVE-2023-25055 | Google XML Sitemap for VideosCross-Site Request Forgery via video_sitemap_generate | ≤ 2.6.1 | |
| Medium | 4.3 | CVE-2023-27633 | CustomifyCross-Site Request Forgery to Settings Update | ≤ 2.10.4 | |
| Medium | 4.3 | CVE-2023-27626 | Stock TickerMissing Authorization via AJAX actions | ≤ 3.23.0 | |
| Medium | 4.3 | CVE-2023-27417 | Affiliate Super AssistentCross-Site Request Forgery to Settings Update and Cache Clearing | ≤ 1.5.1 | |
| Medium | 4.3 | CVE-2023-25486 | CloneMissing Authorization via wp_ajax_tifm_save_decision | ≤ 2.3.7 | |
| Medium | 4.3 | CVE-2023-27444 | DecaLogCross-Site Request Forgery via get_settings_page | ≤ 3.7.0 | |
| Medium | 4.3 | CVE-2023-27438 | WP TransliteraCross-Site Request Forgery | ≤ p1.2.5 | |
| Medium | 4.3 | CVE-2023-25474 | About Me 3000 widgetCross-Site Request Forgery to Plugin Settings Update | ≤ 2.2.6 | |
| Medium | 4.3 | CVE-2023-25467 | Resize at Upload PlusCross-Site Request Forgery | ≤ 1.3 | |
| Medium | 4.3 | CVE-2023-27449 | Total Poll LiteCross-Site Request Forgery | ≤ 4.8.6 | |
| Medium | 4.3 | CVE-2023-27446 | DeepL Pro API translationCross-Site Request Forgery via saveSettings | ≤ 2.1.4 | |
| Medium | 4.3 | CVE-2023-25475 | Smart YouTube PROCross-Site Request Forgery via handle_colorbox_options | ≤ 4.3 | |
| Medium | 4.3 | CVE-2023-25029 | WP Social Bookmarking LightCross-Site Request Forgery | ≤ 2.0.7 | |
| Medium | 4.3 | CVE-2023-24008 | Maspik – Spam blacklistCross-Site Request Forgery | ≤ 0.7.8 | |
| Medium | 4.3 | CVE-2023-22693 | WP Google Tag ManagerCross-Site Request Forgery | ≤ 1.1 | |
| Medium | 4.3 | CVE-2023-25987 | My YouTube ChannelCross-Site Request Forgery to Cache Deletion | ≤ 3.23.3 | |
| Medium | 4.3 | CVE-2023-26011 | Read More Excerpt LinkCross-Site Request Forgery | ≤ 1.5 | |
| Medium | 4.3 | CVE-2023-26014 | Minify HTMLCross-Site Request Forgery in minify_html_menu_options | ≤ 2.1.7 | |
| Medium | 4.3 | CVE-2023-23713 | Theme TweakerCross-Site Request Forgery | ≤ 5.20 | |
| Medium | 4.3 | CVE-2023-22686 | Nice PayPal Button LiteCross-Site Request Forgery | ≤ 1.3.5 | |
| Medium | 4.3 | CVE-2023-22688 | WP Tabs SlidesCross-Site Request Forgery | ≤ 2.0.3 | |
| Medium | 4.3 | CVE-2023-22709 | SRS Simple Hits CounterCross-Site Request Forgery | ≤ 1.1.0 | |
| Medium | 4.3 | CVE-2023-22675 | Fast CacheCross-Site Request Forgery | ≤ 1.5 | |
| Low | 3.1 | CVE-2025-24613 | FV Thoughtful CommentsMissing Authorization | ≤ 0.3.5 |
Complete list of credited CVEs. Data from my researcher profile on Wordfence (opens an external site).