CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1237)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated SQL Injection
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
<6.67Update to 6.67
- High8.8SQL Injection
Mediamatic – Media Library Folders
≤2.8.0Update to 2.8.1
- Medium6.1Reflected Cross-Site Scripting
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<3.2.3Update to 3.2.3
- Medium4.3Subscriber+ Plugin Settings Update
Temporary Login Without Password
≤1.7.0Update to 1.7.1
- Medium4.3Cross-Site Request Forgery
Single Post Exporter
≤1.1.1No patch available
- High7.2Admin+ Local File Inclusion
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤2.4.9Update to 2.5.0
- Medium6.1Reflected Cross-Site Scripting via ppress_cc_data Parameter
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<3.2.3Update to 3.2.3
- Medium6.1Cross-Site Scripting
Activity Log for WordPress
<1.0.21Update to 1.0.21
- Medium6.5Cross-Site Request Forgery
Filter Portfolio Gallery
≤1.5No patch available
- Medium4.3Cross-Site Request Forgery
Wp Limits
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Database for Contact Form 7, WPforms, Elementor forms
≤1.2.3Update to 1.2.4
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
NEX-Forms – Ultimate Forms Plugin for WordPress
≤8.4.2Update to 8.4.3
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
≤6.1.2No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Database Addon for Contact Form 7 – CFDB7
≤1.2.6.1Update to 1.2.6.2
- Medium6.5Cross-Site Request Forgery
Database Addon for Contact Form 7 – CFDB7
≤1.2.5.9Update to 1.2.6.1
- High8.8Authenticated Arbitrary File Upload
WP Popular Posts
≤5.3.2Update to 5.3.3
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Contact Form Email
≤1.3.24Update to 1.3.25
- Medium6.5Unauthorised Vote Export to Email & IP Addresses Disclosure
Like Button Rating ♥ LikeBtn
≤2.6.37Update to 2.6.38
- Medium4.8Admin+ Stored Cross-Site Scripting
Caldera Forms – More Than Contact Forms
<1.9.5Update to 1.9.5
- High8.8Cross-Site Request Forgery
WP Reset
5.00 – 5.98Update to 5.99
- High8.8Missing Authorization to Database Reset
WP Reset
5.00 – 5.98Update to 5.99
- Medium6.1Reflected Cross-Site Scripting
Booking Package
<1.5.11Update to 1.5.11
- Medium5.5Arbitrary File Deletion
Error Log Viewer by BestWebSoft
≤1.1.1Update to 1.1.2
- Medium5.4Authenticated Stored Cross-Site Scripting
Meks Easy Photo Feed Widget
<1.2.4Update to 1.2.4
- Critical9.8Authenticated SQL Injection
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
<4.1.4Update to 4.1.4
- Medium6.4Contributor+ Stored Cross-Site Scripting
Get Custom Field Values
<4.0.1Update to 4.0.1
- Medium6.5Arbitrary Post Metadata Access
Get Custom Field Values
<4.0Update to 4.0
- High7.2Admin+ SQL Injection
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
≤4.3.1Update to 5.0.0
- Medium6.1Reflected Cross-Site Scripting
Email Log
≤2.4.7Update to 2.4.8
- Medium6.1Reflected Cross-Site Scripting via rul_login_url, rul_logout_url Parameter
LoginWP (Formerly Peter's Login Redirect)
<3.0.0.5Update to 3.0.0.5