CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1233)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Directory Traversal/Arbitrary File Read
TrueRanker
≤2.2.2Update to 2.2.4
- Medium6.1Responsive, Flat, Simple FAQ <= 1.4.8 - Reflected Cross-Site Scripting
duoFAQ - Responsive, Flat, Simple FAQ
≤1.4.8No patch available
- Medium6.1Reflected Cross-Site Scripting
Simple Image Gallery
≤1.0.6No patch available
- Medium6.1Reflected Cross-Site Scripting
Parsian Bank Gateway for Woocommerce
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Magic Post Voice
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
H5P CSS Editor
≤1.0No patch available
- Medium4.7Reflected Cross-Site Scripting
WP Cloud Plugins - Box (Lets-Box)
<1.15.3Update to 1.15.3
- Medium6.1WooCommerce EnvioPack <= 1.2 Reflected Cross-Site Scripting
WooCommerce EnvioPack
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
link-list-manager
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Real WYSIWYG
≤0.0.2No patch available
- Medium6.1Reflected Cross-Site Scripting
FOX – Currency Switcher Professional for WooCommerce
≤1.3.7.2Update to 1.3.7.3
- Medium6.1Reflected Cross-Site Scripting
Out-of-the-Box
<1.20.3Update to 1.20.3
- Critical9.8Pro <= 5.0.6 - SQL Injection
The Plus Addons for Elementor Page Builder Pro
<5.0.7Update to 5.0.7
- Medium6.1.htaccess Redirect <= 0.3.1 Reflected Cross-Site Scripting
.htaccess Redirect
≤0.3.1No patch available
- High7.5Sensitive Data Disclosure
The Plus Addons for Elementor Page Builder Pro
<5.0.7Update to 5.0.7
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
AMP for WP – Accelerated Mobile Pages
≤1.0.77.31Update to 1.0.77.32
- Medium6.1Reflected Cross-Site Scripting
WP Booking System – Booking Calendar
<2.0.15Update to 2.0.15
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
tarteaucitron.io – Cookie Banner & GDPR Consent Management
≤1.5.4Update to 1.6
- Medium6.5Arbitrary Post Deletion via Cross-Site Request Forgery
Accept Donations with PayPal & Stripe
≤1.3.3Update to 1.3.4
- Medium4.8Stored Cross-Site Scripting
Fathom Analytics for WP
≤3.0.4Update to 3.0.5
- Medium5.4Missing Authorization
Maps Plugin using Google Maps for WordPress – WP Google Map
≤1.8.0Update to 1.8.1
- Critical9.8Unauthenticated Arbitrary Options Update
PublishPress Capabilities: User Role Access Control, Admin Area Permissions
<2.3.1Update to 2.3.1
- Critical9.8Authentication Bypass
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤5.0.1.7Update to 5.0.1.8
- Medium5.7Subscriber+ Arbitrary Post Deletion and Plugin Settings Update
Maps Plugin using Google Maps for WordPress – WP Google Map
≤1.8.0Update to 1.8.1
- Medium6.1Reflected Cross-Site Scripting
10WebSocial
≤1.4.28Update to 1.4.29
- High7.5Unauthenticated Arbitrary Tab Modification
Tab – Accordion, FAQ
<1.3.2Update to 1.3.2
- High8.8Subscriber+ SQL Injection
Events Made Easy
≤2.2.35Update to 2.2.36
- High7.5Denial of Service
Stars Rating
<3.5.1Update to 3.5.1
- High8.8SQL Injection
WPcalc – create any online calculators
≤2.1No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Site Reviews
≤5.17.2Update to 5.17.3