VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-862Vulnerability type

WordPress Missing Authorization vulnerabilities (page 1242)

AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.

Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Missing Authorization vulnerabilities (page 1242)
SeverityVulnerabilityCVEInstallsPublished
Medium4.8Admin+ Stored Cross-Site Scripting
Print-O-Matic≤2.0.2Update to 2.0.3
CVE-2021-24710—
Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Quiz Tool Lite≤2.3.15No patch available
CVE-2021-24701—
High8.8SQL Injection
MAZ Loader – Preloader Builder for WordPress<1.3.3Update to 1.3.3
CVE-2021-24669—
Medium6.5Authenticated PHP Code Injection
Loco Translate<2.5.4Update to 2.5.4
CVE-2021-24721—
Critical9.8Authentication Bypass
Pie Register – User Registration, Profiles & Content Restriction≤3.7.1.4Update to 3.7.1.5
CVE-2025-34077—
Medium4.8Stored Cross-Site Scripting
School Management System – WPSchoolPress<2.1.17Update to 2.1.17
CVE-2021-24664—
High8.8Frontend Manager for WooCommerce <= 6.5.11 - Customer/Subscriber+ SQL Injection
WCFM – Frontend Manager for WooCommerce≤6.5.11Update to 6.5.12
CVE-2021-24835—
High8.8SQL Injection
School Management System – WPSchoolPress<2.1.10Update to 2.1.10
CVE-2021-24575—
High8.8Cross-Site Request Forgery
WP SEO Redirect 301<2.3.2Update to 2.3.2
CVE-2021-24832—
Medium6.1Reflected Cross-Site Scripting
WP Header Images<2.0.1Update to 2.0.1
CVE-2021-24798—
High7.2Admin+ SQL injection
Affiliates Manager≤2.8.6Update to 2.8.7
CVE-2021-24844—
Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Storefront Footer Text≤1.0.1No patch available
CVE-2021-24607—
Medium5.5Stored Cross-Site Scripting
Qwizcards | online quizzes and flashcards≤3.61Update to 3.62
CVE-2021-24706—
Medium5.3Modern Blog WordPress Theme < 3.0.4 - Authorization Bypass
Squaretype - Modern Blog WordPress Theme<3.0.4Update to 3.0.4
CVE-2021-24840—
Medium5.5Authenticated (Editor+) Stored Cross-Site Scripting
Comment Engine Pro≤1.0No patch available
CVE-2021-36911—
High8.8Cross-Site Request Forgery
Chameleon CSS≤1.2No patch available
CVE-2021-24626—
Medium6.4Agent+ Stored Cross-Site Scripting
Support Board≤3.3.4Update to 3.3.5
CVE-2021-24807—
High7.2Authenticated (Admin+) SQL Injection
Post Content XMLRPC≤1.0No patch available
CVE-2021-24629—
High7.2Authenticated (Admin+) SQL Injection
SpiderCatalog≤1.7.3No patch available
CVE-2021-24625—
High7.2Authenticated (Admin+) SQL Injection
G Auto-Hyperlink≤1.0.1No patch available
CVE-2021-24627—
High7.2Authenticated (Admin+) SQL Injection
Wow Forms – create any form with custom style≤3.1.3No patch available
CVE-2021-24628—
High7.2Authenticated (Admin+) SQL Injection
Unlimited PopUps≤4.5.3No patch available
CVE-2021-24631—
High8.8Authenticated (Author+) SQL Injection
Schreikasten≤0.14.18No patch available
CVE-2021-24630—
High8.8Authenticated (Subscriber+) Arbitrary File Upload
Arrival≤1.4.2Update to 1.4.3
CVE-2021-39317—
Medium4.3Log Deletion via Cross-Site Request Forgery
Redirect 404 Error Page to Homepage or Custom Page with Logs≤1.7.8Update to 1.7.9
CVE-2021-24767—
Medium4.8Admin+ Stored Cross-Site Scripting
WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel<1.3.1Update to 1.3.1
CVE-2021-24708—
High8.8Subscriber+ SQL Injection
Visitor Traffic Real Time Statistics≤3.8Update to 3.9
CVE-2021-24829—
Medium4.3Cross-Site Request Forgery
Genie WP Favicon≤0.5.2No patch available
CVE-2021-24674—
Medium4.8Admin+ Stored Cross-Site Scripting
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder<5.0.07Update to 5.0.07
CVE-2021-24608—
Medium4.3Author Arbitrary Media File Renaming
Phoenix Media Rename≤3.4.2Update to 3.4.4
CVE-2021-24816—

Search VulnCrest Radar

Jump to

Are you sure?