CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1254)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Subscriber+ Arbitrary File Upload
SP Project & Document Manager
<4.24Update to 4.24
- Critical9.8Privilege Escalation
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium4.3Cross-Site Request Forgery leading to Settings Change
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium6.5Cross-Site Request Forgery
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium5.4Cross-Site Request Forgery
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium6.1Reflected Cross-Site Scripting
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium6.1Reflected Cross-Site Scripting
Favicon by RealFaviconGenerator
<1.3.21Update to 1.3.21
- High7.1Authenticated Insecure Direct Object References (IDOR)
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- High8.8Cross-Site Request Forgery
Blue Admin
≤21.06.01No patch available
- High8.8add sticky fixed buttons < 2.2.6 - SQL Injection
Side Menu Lite – Sticky Floating Side Menu
<2.2.6Update to 2.2.6
- High8.8Cross-Site Request Forgery
SEO Backlinks
≤4.0.1No patch available
- High8.8Admin Custom Login <= 3.2.7 – Cross-Site Request Forgery to Stored Cross-Site Scripting
Admin Custom Login
≤3.2.7Update to 3.2.8
- Medium4.8Authenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
<2.12.0Update to 2.12.0
- Medium5.4Stored Cross-Site Scripting
HD Quiz
<1.8.4Update to 1.8.4
- Critical9.9Authenticated WordPress Options Change
Advanced Shipment Tracking for WooCommerce
≤3.2.6Update to 3.2.7
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
LukasApps CAPTCHA tools for Contact Form 7
<0.0.9Update to 0.0.9
- Medium6.1Poll Maker <= 3.2.8 – Reflected Cross-Site Scripting
Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls
≤3.2.8Update to 3.2.9
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website
≤2.10.3Update to 2.10.4
- Medium5.4Authenticated Stored Cross-Site Scripting
WPFront Scroll Top
≤2.0.5Update to 2.0.6
- Medium6.4Cross-Site Scripting
Qyrr – simply and modern QR-Code creation
≤0.7Update to 0.8
- High8.8Post Index <= 0.7.5 Cross-Site Request Forgery to Stored Cross-Site Scripting
Post Index
≤0.7.5No patch available
- Critical9.8Unauthenticated SQL Injection
Directory Listings WordPress plugin – uListing
≤2.0.3Update to 2.0.4
- High8.8SQL Injection
Slider Hero with Video Background, Animation
<8.2.7Update to 8.2.7
- Medium5.4Contributor+ Stored Cross-Site Scripting
Simple Social Media Share Buttons – Social Sharing for Everyone
≤3.2.2Update to 3.2.3
- Medium5.5Authenticated Stored Cross-Site Scripting
WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS
<5.4.13Update to 5.4.13
- Medium4.9Authenticated (Admin+) Arbitrary File Read
AceIDE
≤2.6.2No patch available
- High7.2Authenticated (Admin+) SQL Injection
Timeline Calendar
≤1.2No patch available
- Medium6.1Stored Cross-Site Scripting
Email Subscriber
≤1.1No patch available
- High7.2Authenticated SQL Injection
Simple Events Calendar
≤1.4.0Update to 1.4.1
- High7.2Authenticated (Admin+) SQL Injection
Broken Link Manager
≤0.6.5No patch available