CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1246)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery to Remote Code Execution and/or Cross-Site Scripting
Scroll Baner
≤1.0No patch available
- Medium6.4Cross-Site Scripting
Easy Feeds for X/Twitter – keep your site fresh with live social posts
<1.2Update to 1.2
- Critical9.8Authentication Bypass via Password Reset
YITH Easy Login & Register Popup for WooCommerce
≤1.8.0Update to 1.8.1
- Medium5.4Stored Cross-Site Scripting
One User Avatar | User Profile Picture
<2.3.7Update to 2.3.7
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Customer Support Ticket System & Helpdesk
<5.10.4Update to 5.10.4
- Medium5.4Cross-Site Scripting
StreamCast – bring live radio to your site with a sleek player
<2.1.1Update to 2.1.1
- Medium5.5Admin+ Stored Cross-Site Scripting
Tutor LMS – eLearning and online course solution
<1.9.9Update to 1.9.9
- Medium5.4Reflected Cross-Site Scripting
eID Easy
≤4.6Update to 4.7
- Medium5.3Sensitive Information Disclosure
BulletProof Security
≤5.1Update to 5.2
- Medium6.9Stored Cross-Site Scripting
YITH Maintenance Mode
≤1.3.7Update to 1.3.8
- Medium6.4Contributor+ Stored Cross-Site Scripting
Compact WP Audio Player
≤1.9.6Update to 1.9.7
- Critical9.9Authenticated Command Injection
WordPress PDF Light Viewer Plugin
≤1.4.11Update to 1.4.12
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
PlanSo Forms
≤2.6.4No patch available
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Shared Files – File Upload & Download Manager
<1.6.57Update to 1.6.57
- Medium4.3Setting Change via Cross-Site Request Forgery
Compact WP Audio Player
≤1.9.6Update to 1.9.7
- Medium6.4Contributor+ Stored Cross-Site Scripting
DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
≤1.7.12Update to 1.7.13
- Medium5.3Sensitive Information Disclosure
Find My Blocks – Locate blocks on your site
<3.4.0Update to 3.4.0
- Medium6.4Stored Cross-Site Scripting
Podcast Subscribe Buttons
<1.4.2Update to 1.4.2
- Medium4.8wpDiscuz <= 7.3.0 - Authenticated Stored Cross-Site Scripting
Comments – wpDiscuz
≤7.3.0Update to 7.3.2
- Medium6.4Authenticated Stored Cross-Site Scripting
Coming soon and Maintenance mode
<3.5.3Update to 3.5.3
- Medium6.5Missing Authorization
CURCY - WooCommerce Multi Currency - Currency Switcher
≤2.1.17Update to 2.1.18
- Medium4.3Missing Authorization
CURCY – Multi Currency for WooCommerce
≤2.1.17Update to 2.1.18
- Critical9.8Arbitrary File Upload
Download from files
≤1.48No patch available
- High7.5Unauthenticated SQL Injection
Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls
<3.4.2Update to 3.4.2
- Medium4.3Cross-Site Request Forgery leading to Arbitrary Domain Deletion
Software License Manager
<4.5.1Update to 4.5.1
- Medium4.8Admin+ Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤7.3.1Update to 7.3.2
- Medium4.8Admin+ Stored Cross-Site Scripting
Simple Social Media Share Buttons – Social Sharing for Everyone
≤3.2.3Update to 3.2.4
- Medium6.1Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤7.1.13Update to 7.1.14
- High8.8Authenticated (Contributor+) Code Injection
Gutenberg Block Editor Toolkit – EditorsKit
≤1.31.5Update to 1.31.6
- Medium6.5Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤13.1.1Update to 13.1.2