CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1282)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.3Missing Authorization
WP Activity Log
<4.0.2Update to 4.0.2
- Critical9.1Unauthenticated Database Wiping
Custom Searchable Data Entry System
≤1.7.1No patch available
- High8.0Cross-Site Request Forgery to Settings Modification
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<4.6.0.4Update to 4.6.0.4
- Critical9.9Authenticated Privilege Escalation
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<4.6.0.4Update to 4.6.0.4
- Critical9.9Authenticated Settings Import to Privilege Escalation
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤4.6.0.3Update to 4.6.0.4
- Medium4.3Authenticated Email Injection
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤4.6.0.3Update to 4.6.0.4
- Medium4.3Authenticated Settings and User Data Export
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<4.6.0.4Update to 4.6.0.4
- Medium4.8Stored Cross-Site Scripting
Appointment Booking Calendar
<1.3.35Update to 1.3.35
- High7.8CSV Injection
Appointment Booking Calendar
<1.3.35Update to 1.3.35
- Critical9.1Unprotected AJAX Actions
Responsive Starter Templates – Elementor Templates & Starter Sites
<2.2.6Update to 2.2.7
- Medium5.3Unauthenticated Coupon Creation
WooCommerce Smart Coupons
<4.6.5Update to 4.6.5
- High7.5VulnCrest analysisKEVPoCDirectory Traversal
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
<1.3.28Update to 1.3.28
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Async JavaScript
<2.20.02.27Update to 2.20.02.27
- Medium5.4Missing Authorization to Stored Cross-Site Scripting and Settings Update
Modern Events Calendar Lite
<5.1.7Update to 5.1.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Plugin Settings Change
10Web Map Builder for Google Maps
<1.0.64Update to 1.0.64
- Medium6.4Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.9.2Update to 2.9.3
- Medium6.1Unauthenticated Stored Cross-Site Scripting
WP Job Board
≤5.5.3Update to 5.6.0
- High7.2Unauthenticated Arbitrary Plugin Settings Update
Flexible Checkout Fields for WooCommerce – WooCommerce Checkout Manager
<2.3.2Update to 2.3.2
- Medium6.4Authenticated Stored Cross-Site Scripting
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
<1.7.7Update to 1.7.7
- High7.3Missing Authorization on AJAX Actions
Pricing Table by Supsystic – Responsive Pricing Plans & Comparison Tables
≤1.8.1Update to 1.8.2
- Medium6.1Reflected Cross-Site Scripting
Hero Maps Premium
≤2.2.2Update to 2.2.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Pricing Table by Supsystic – Responsive Pricing Plans & Comparison Tables
≤1.8.1Update to 1.8.2
- High8.8Cross-Site Request Forgery to Cross-Site Scripting and Setting Changes
Pricing Table by Supsystic – Responsive Pricing Plans & Comparison Tables
≤1.8.1Update to 1.8.2
- Medium5.5Multiple Cross-Site Scripting Issues
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.45Update to 1.5.46
- High8.1Lack of Origin Validation
CardGate Payments for WooCommerce
<3.1.16Update to 3.1.16
- Medium6.4Authenticated Stored Cross-Site Scripting
Modula Image Gallery – Photo Grid & Video Gallery
<2.2.5Update to 2.2.5
- Medium6.4Stored Cross-Site Scripting
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
<1.5.9Update to 1.5.9
- High8.8Cross-Site Request Forgery
Easy Property Listings
<3.4Update to 3.4
- Critical9.8Improper Access Control to Privilege Escalation
wpCentral
≤1.5.0Update to 1.5.1
- Critical9.82.6.7.6 - PHP Object Injection
Popup Builder – Create highly converting, mobile friendly marketing popups.
2.2.8 – 2.6.7.6Update to 3.0