CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1241)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Author+ Stored Cross-Site Scripting via Options Module
YOP Poll
≤6.3.0Update to 6.3.1
- Medium5.4Author+ Stored Cross-Site Scripting via Preview Module
YOP Poll
≤6.3.0Update to 6.3.1
- Medium6.1Stored Cross-Site Scripting
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
≤15.3Update to 15.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Job Board Vanila Plugin
1.0 – 1.0No patch available
- Medium5.5Stored Cross-Site Scripting
WordPress ERP, HR, CRM, and Project Management Plugin – Business Manager
≤1.4.5Update to 1.4.6
- Medium5.5Stored Cross-Site Scripting
WpGenius Job Listing
≤1.0.2Update to 1.0.3
- High8.8Authenticated (Subscriber+) SQL Injection
WP Fastest Cache – WordPress Cache Plugin
<0.9.5Update to 0.9.5
- Medium5.5HAL <= 2.1.1 Authenticated Stored Cross-Site Scripting
HAL
≤2.1.1Update to 2.2
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
MyBB Cross-Poster
≤1.0No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
job-portal
≤0.0.1No patch available
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Fastest Cache – WordPress Cache Plugin
<0.9.5Update to 0.9.5
- Medium5.5Authenticated Stored Cross-Site Scripting
Author Bio Box
≤3.3.1Update to 3.3.2
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
KJM Admin Notices
≤2.0.1No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Job Manager
≤0.7.25No patch available
- High8.8Authenticated File Upload and Path Traversal
Brizy – Page Builder
≤2.3.11Update to 2.3.12
- High8.8Authenticated (Admin+) SQL Injection
WP Cloudy, weather plugin
≤4.4.9No patch available
- High7.5Insecure Password Creation
Simple JWT Login – Allows you to use JWT on REST endpoints.
<3.3.0Update to 3.3.0
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Testimonial – WordPress Testimonial Showcase Plugin Grid Plus Testimonial Slider
<1.6.0Update to 1.6.0
- Medium6.4Page Builder <= 2.3.11 - Stored Cross-Site Scripting
Brizy – Page Builder
≤2.3.11Update to 2.3.12
- Medium4.3Cross-Site Request Forgery
Colorful Categories
<2.0.15Update to 2.0.15
- High8.8Backdoored
Frontend Post WordPress Plugin – AccessPress Anonymous Post
2.8.0 – 2.8.0Update to 2.8.1
- Medium5.4Authenticated Stored Cross-Site Scripting
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
≤2.4.13Update to 2.4.14
- Medium4.3Contributor+ Arbitrary Post Schedule Deletion
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
≤2.5.1Update to 2.6.0
- High8.1Authentication Bypass
Pie Register – User Registration, Profiles & Content Restriction
<3.7.1.6Update to 3.7.1.6
- Critical9.8Unauthenticated SQL Injection
Asgaros Forum
≤1.15.12Update to 1.15.13
- High7.2Authenticated SQL Injections
Header Footer Code Manager
<1.1.14Update to 1.1.14
- High8.8Cross-Site Request Forgery
WP SEO Redirect 301
<2.3.2Update to 2.3.2
- Medium6.1Reflected Cross-Site Scripting
WP Header Images
<2.0.1Update to 2.0.1
- Medium6.5Authenticated PHP Code Injection
Loco Translate
<2.5.4Update to 2.5.4
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Quiz Tool Lite
≤2.3.15No patch available