What’s Vulnerable › Products

wickedplugins Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types vulnerabilities

22 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 1 published in the last 12 months.

Check whether your wickedplugins Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types version is affected

Latest wickedplugins Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types vulnerabilities

• CVE-2026-1883 — Wicked Folders <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletion (CVSS 4.3)
• CVE-2023-0729 — Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_sort_order (CVSS 4.3)
• CVE-2023-0726 — Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_edit_folder (CVSS 4.3)
• CVE-2023-0725 — Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_clone_folder (CVSS 4.3)
• CVE-2023-0724 — Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_add_folder (CVSS 4.3)
• CVE-2023-0722 — Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_state (CVSS 4.3)
• CVE-2023-0720 — Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_folder_order (CVSS 4.3)
• CVE-2023-0717 — Wicked Folders <= 2.18.16 - Missing Authorization via ajax_delete_folder (CVSS 4.3)
• CVE-2023-0716 — Wicked Folders <= 2.18.16 - Missing Authorization on ajax_edit_folder (CVSS 4.3)
• CVE-2023-0715 — Wicked Folders <= 2.18.16 - Missing Authorization on ajax_clone_folder (CVSS 4.3)
• CVE-2023-0711 — Wicked Folders <= 2.18.16 - Missing Authorization via ajax_save_state (CVSS 4.3)
• CVE-2023-0685 — Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_unassign_folders (CVSS 4.3)
• CVE-2023-0684 — Wicked Folders <= 2.18.16 - Missing Authorization via ajax_unassign_folders (CVSS 4.3)
• CVE-2023-0718 — Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_folder (CVSS 4.3)
• CVE-2023-0730 — Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_folder_order (CVSS 4.3)
• CVE-2023-0727 — Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_delete_folder (CVSS 4.3)
• CVE-2023-0723 — Wicked Folders <= 2.18.16 - Cross-Site Request Forgery on ajax_move_object (CVSS 4.3)
• CVE-2023-0719 — Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_sort_order (CVSS 4.3)
• CVE-2023-0712 — Wicked Folders <= 2.18.16 - Missing Authorization on ajax_move_object (CVSS 4.3)
• CVE-2023-0728 — Wicked Folders <= 2.18.16 - Cross-Site Request Forgery on ajax_save_folder (CVSS 4.3)
• CVE-2023-0713 — Wicked Folders <= 2.18.16 - Missing Authorization on ajax_add_folder (CVSS 4.3)
• CVE-2021-24919 — Wicked Folders < 2.18.10 - Subscriber+ SQL Injection (CVSS 8.8)