CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1234)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
UpdraftPlus Premium
<1.16.66Update to 1.16.66
- High7.5Denial of Service
Stars Rating
<3.5.1Update to 3.5.1
- Medium4.8Reflected Cross-Site Scripting via tab and section parameter
PDF Invoices & Packing Slips for WooCommerce
<2.10.5Update to 2.10.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Site Reviews
≤5.17.2Update to 5.17.3
- High8.8SQL Injection
WPcalc – create any online calculators
≤2.1No patch available
- High8.8Subscriber+ SQL Injection
Events Made Easy
≤2.2.35Update to 2.2.36
- High7.5Unauthenticated Arbitrary Tab Modification
Tab – Accordion, FAQ
<1.3.2Update to 1.3.2
- High8.8Cross-Site Request Forgery
Button Generator – Easily Create Custom Buttons with Icons and Analytics
≤2.3.2Update to 2.3.3
- High8.8Cross-Site Request Forgery to Remote Code Execution
Modal Window – create popup modal window
<5.2.2Update to 5.2.2
- High8.8Remote File Inclusion leading to Remote Code Execution via Cross-Site Request Forgery
WP Coder – Insert & Manage Code Snippets
≤2.5.1Update to 2.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Survey Maker by AYS
≤2.0.6Update to 2.0.7
- Medium5.4Subscriber+ Category Add Leading to Stored Cross-Site Scripting
Modern Events Calendar Lite
≤6.1.6Update to 6.2.0
- Medium5.4Cross-Site Scripting
Customize Login Image
≤3.4Update to 3.5
- High7.5Missing Authorization to Information Disclosure
Advanced Custom Fields (ACF®)
<5.11Update to 5.11
- Medium6.4Cross-Site Scripting
Post Duplicator
<2.24Update to 2.24
- Medium6.5Missing Authorization to Information Disclosure
Advanced Custom Fields (ACF®)
<5.11Update to 5.11
- Medium4.3Missing Authorization on Option Changes
Advanced Custom Fields (ACF®)
<5.11Update to 5.11
- Medium6.1Reflected Cross-Site Scripting in Product XML Feeds Module
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
<5.4.9Update to 5.4.9
- Medium4.9Admin+ Arbitrary Folder Deletion via Path Traversal
CAOS | Host Google Analytics Locally
≤4.1.8Update to 4.1.9
- Medium6.1Reflected Cross-Site Scripting in General Module
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
<5.4.9Update to 5.4.9
- Medium6.1Reflected Cross-Site Scripting in PDF Invoicing Module
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
<5.4.9Update to 5.4.9
- Medium5.5Editor+ Stored Cross-Site Scripting
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
≤5.3.0Update to 5.3.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Variation Swatches for WooCommerce
≤2.1.1Update to 2.1.2
- Medium4.9Authenticated (Admin+) Arbitrary Folder Deletion via Path Traversal
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
≤4.5.11Update to 4.5.12
- Medium6.1Reflected Cross-Site Scripting via qc_res
LiteSpeed Cache
1.0.15 – 4.4.3Update to 4.4.4
- Medium6.5Authorization Bypass
LiteSpeed Cache
1.0.15 – 4.4.3Update to 4.4.4
- High8.8Cross-Site Request Forgery
Contact Form With Captcha
≤1.6.7Update to 1.6.8
- Medium6.1Reflected Cross-Site Scripting
MOLIE – Instructure Canvas Linking tool
≤0.5No patch available
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Typebot
<1.4.3Update to 1.4.3
- Medium6.4Cross-Site Scripting
Download Manager
<3.2.22Update to 3.2.22