CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1236)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Stored Cross-Site Scripting
Logo Carousel
<1.7.2Update to 1.7.2
- High7.2File Uploads Extension <= 3.3.12 - Reflected Cross-Site Scripting
Ninja Forms - File Uploads
≤3.3.12Update to 3.3.13
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Easy Registration Forms
≤2.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Preview E-mails for WooCommerce
≤1.6.8Update to 2.0.0
- Medium6.4Reflected Cross-Site Scripting
Child Theme Generator
≤2.2.7No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Backup Migration
≤1.1.5Update to 1.1.6
- High8.8Cross-Site Request Forgery
Push Notifications for WordPress (Lite)
<6.0.1Update to 6.0.1
- Medium6.4Cross-Site Scripting
Mortgage Calculator
<1.5.17Update to 1.5.17
- Medium6.1Reflected Cross-Site Scripting
SportsPress – Sports Club & League Manager
≤2.7.8Update to 2.7.9
- Critical9.8Unauthenticated Arbitrary File Upload
Wordpress Plugin Smart Product Review
≤1.0.4Update to 1.0.5
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤7.0.6.1Update to 7.0.6.2
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Pixel Cat – Conversion Pixel Manager
≤2.6.1Update to 2.6.2
- Medium4.3Subscriber+ Plugin Settings Update
Temporary Login Without Password
≤1.7.0Update to 1.7.1
- Critical9.0Unauthenticated PHP Object Injection
ToTop Link
≤1.7.1No patch available
- Medium4.3Cross-Site Request Forgery
Single Post Exporter
≤1.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting via current_month_divider parameter
Modern Events Calendar Lite
≤6.1.0Update to 6.1.5
- Medium6.1Reflected Cross-Site Scripting
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<3.2.3Update to 3.2.3
- Medium4.3Improper Access Control
User meta shortcodes
≤0.5No patch available
- High7.2Admin+ Local File Inclusion
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤2.4.9Update to 2.5.0
- High7.2Admin+ SQL Injection
SEO Booster
≤3.7Update to 3.8
- High7.2Authenticated (Admin+) SQL Injection
Quotes Collection
≤2.5.2No patch available
- High8.5Missing Authorization
Contact Form Advanced Database
≤1.0.8No patch available
- Medium4.3Missing Authorization
Page/Post Content Shortcode
≤1.0No patch available
- Medium5.4Stored Cross-Site Scripting
Display Post Metadata
<1.5.0Update to 1.5.0
- High8.8SQL Injection
Mediamatic – Media Library Folders
≤2.8.0Update to 2.8.1
- Medium4.3Plugin's Settings Update via Cross-Site Request Forgery
WP Admin Logo Changer
≤1.0No patch available
- Medium4.8Authenticated (Admin+) Cross-Site Scripting
Security Audit
≤1.0.0No patch available
- Medium4.3Authenticated (Contributor+) Arbitrary Posts/Pages Access
Improved Include Page
≤1.2No patch available
- Medium6.5Cross-Site Request Forgery
Filter Portfolio Gallery
≤1.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Shiny Buttons – CSS3 Button Generator for WordPress
≤1.1.0No patch available