CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1240)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Local File Inclusion
Images to WebP
≤1.8Update to 1.9
- High7.5SQL Injection
Mang Board
≤1.9.9Update to 2.0.0
- Medium6.5SQL Injection
Duplicate Post
<1.2.0Update to 1.2.0
- Medium5.4Stored Cross-Site Scripting
Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid
<1.2.4Update to 1.2.4
- Medium5.7Cross-Site Request Forgery
Download Plugin
<1.6.1Update to 1.6.1
- Medium5.5Stored Cross-Site Scripting via $custom_profile
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.1.3.1Update to 4.1.3.2
- Medium4.3Cross-Site Request Forgery
QR Redirector
<1.6Update to 1.6
- Medium4.8Cross-Site Scripting
Shared Files – File Upload & Download Manager
<1.6.61Update to 1.6.61
- Medium6.1Unauthenticated Stored Cross-Site Scripting
My Tickets – Accessible Event Ticketing
<1.8.31Update to 1.8.31
- High7.2Admin+ SQL Injection
Email Log
≤2.4.6Update to 2.4.7
- Medium4.3Contributor+ Arbitrary Posts/Pages Access
Insert Pages
≤3.6.1Update to 3.7.0
- High8.8Subscriber+ SQL Injection
SEO Redirection Plugin – 301 Redirect Manager
≤8.1Update to 8.2
- Medium4.8Authenticated Stored Cross-Site Scripting
Sprout Invoices – Client Invoicing & Estimates
<19.9.7Update to 19.9.7
- High7.2Admin+ SQL Injection
Stream – Activity Log & Audit Trail
≤3.8.1Update to 3.8.2
- Medium6.5Plugin's Setting Update via Cross-Site Request Forgery
MouseWheel Smooth Scroll
≤5.6Update to 5.7
- Medium6.4Contributor+ Stored Cross-Site Scripting
Insert Pages
≤3.6.1Update to 3.7.0
- Medium5.5Leaky Paywall <= 4.16.5 Authenticated Stored Cross-Site Scripting
Leaky Paywall
≤4.16.5Update to 4.16.6
- Medium4.8Admin+ Stored Cross-Site Scripting
Accept Donations with PayPal & Stripe
≤1.3.1Update to 1.3.2
- Medium5.5Admin+ Stored Cross-Site Scripting
Helpful
<4.4.59Update to 4.4.59
- High8.8Cross-Site Request Forgery
Simple JWT Login – Allows you to use JWT on REST endpoints.
<3.2.1Update to 3.2.1
- High8.1Cross-Site Request Forgery
Support Board
<3.3.6Update to 3.3.6
- Medium5.4Stored Cross-Site Scripting
QR Redirector
<1.6.1Update to 1.6.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Content Staging
≤2.0.1No patch available
- Medium4.3Settings Change via Cross-Site Request Forgery
WP Performance Score Booster – Optimize Speed, Enable Cache & Page Preload
≤2.0Update to 2.1
- Medium5.4Authenticated Stored Cross-Site Scripting
Microsoft Clarity
≤0.3Update to 0.4
- Medium6.1Responsive Multi-Purpose Theme < 4.8.4 - Reflected Cross-Site Scripting
enfold
<4.8.4Update to 4.8.4
- High7.2Admin+ SQL Injection
Speed Booster Pack ⚡ PageSpeed Optimization Suite
≤4.3.3Update to 4.3.3.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Indeed Job Importer
≤1.0.5No patch available
- Medium5.5Stored Cross-Site Scripting
JobBoardWP – Job Board Listings and Submissions
≤1.0.7Update to 1.1.0
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
MPL-Publisher — Ebook & Audiobook Creator
≤1.30.2Update to 1.30.3