CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1290)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2019-17384 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-17385 | — | |
| Medium6.5 | Cross-Site Request Forgery | CVE-2019-14327 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-17386 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-14328 | — | |
| Critical9.8 | SQL Injection | CVE-2019-14313 | — | |
| Critical9.8 | SQL Injection | CVE-2019-13572 | — | |
| Medium5.3 | Login Page Disclosure via 'action=rp' | CVE-2019-15825 | — | |
| Critical9.8 | Directory Traversal | CVE-2019-15822 | — | |
| Medium5.3 | Login Page Disclosure via 'action=confirmaction' | CVE-2019-15823 | — | |
| Medium5.3 | Login Page Disclosure via Referer Header | CVE-2019-15826 | — | |
| Critical9.8 | SQL Injection | CVE-2019-13569 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2019-14945 | — | |
| Medium5.3 | Login Page Disclosure via 'adminhash' | CVE-2019-15824 | — | |
| Critical9.8 | SQL Injection | CVE-2019-14230 | — | |
| Critical10.0 | OnionBuzz < 1.2.2 - SQL Injection | CVE-2019-14231 | — | |
| High7.5 | Arbitrary File Deletion | CVE-2019-14206 | — | |
| High7.5 | Local File Inclusion | CVE-2019-14205 | — | |
| High8.8 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2019-12934 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2019-15827 | — | |
| Critical9.8 | SQL Injection | CVE-2019-13575 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-5993 | — | |
| Medium6.5 | Unauthenticated Settings Reset | CVE-2019-25139 | — | |
| High7.2 | Stored Cross Site Scripting | CVE-2019-25140 | — | |
| High8.8 | SQL Injection | CVE-2019-1010034 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-5992 | — | |
| High8.8 | Authenticated Remote Code Execution | CVE-2019-15324 | — | |
| High7.5 | Authenticated Path Traversal | CVE-2019-15323 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-14364 | — | |
| Critical9.8 | SQL Injection | CVE-2019-13573 | — |
- Medium6.1Cross-Site Scripting
Animate It!
≤2.3.5Update to 2.3.6
- Medium6.1Cross-Site Scripting
Animate It!
≤2.3.5Update to 2.3.6
- Medium6.5Cross-Site Request Forgery
Custom Simple Rss
<2.0.7Update to 2.0.7
- High8.8Cross-Site Request Forgery
Animate It!
≤2.3.5Update to 2.3.6
- High8.8Cross-Site Request Forgery
Simple Membership
<3.8.5Update to 3.8.5
- Critical9.8SQL Injection
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.31Update to 1.5.31
- Critical9.8SQL Injection
Blog2Social: Social Media Auto Post & Scheduler
<5.6.0Update to 5.6.0
- Medium5.3Login Page Disclosure via 'action=rp'
WPS Hide Login
≤1.5.2.2Update to 1.5.3
- Critical9.8Directory Traversal
WPS Child Theme Generator
≤1.1Update to 1.2
- Medium5.3Login Page Disclosure via 'action=confirmaction'
WPS Hide Login
<1.5.3Update to 1.5.3
- Medium5.3Login Page Disclosure via Referer Header
WPS Hide Login
≤1.5.2.2Update to 1.5.3
- Critical9.8SQL Injection
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤4.1.7Update to 4.1.8
- Medium6.4Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.53Update to 2.0.54
- Medium5.3Login Page Disclosure via 'adminhash'
WPS Hide Login
≤1.5.2.2Update to 1.5.3
- Critical9.8SQL Injection
OnionBuzz
<1.2.7Update to 1.2.7
- Critical10.0OnionBuzz < 1.2.2 - SQL Injection
OnionBuzz
≤1.2.1Update to 1.2.2
- High7.5Arbitrary File Deletion
Adaptive Images for WordPress
<0.6.67Update to 0.6.67
- High7.5Local File Inclusion
Adaptive Images for WordPress
<0.6.67Update to 0.6.67
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
WP Code Highlight.js
<0.6.3Update to 0.6.3
- Medium6.4Stored Cross-Site Scripting
OneSignal – Web Push Notifications
≤1.17.7Update to 1.17.8
- Critical9.8SQL Injection
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
<1.5.0Update to 1.5.0
- High8.8Cross-Site Request Forgery
Category Specific RSS feed Subscription
≤2.0Update to 2.1
- Medium6.5Unauthenticated Settings Reset
Coming Soon Page & Maintenance Mode
≤1.8.1Update to 1.8.2
- High7.2Stored Cross Site Scripting
Coming Soon Page & Maintenance Mode
<1.8.2Update to 1.8.2
- High8.8SQL Injection
WebLibrarian
≤3.5.4Update to 3.5.5
- High8.8Cross-Site Request Forgery
WordPress Ultra Simple Paypal Shopping Cart
≤4.4Update to 4.5
- High8.8Authenticated Remote Code Execution
Ad Inserter – Ad Manager & AdSense Ads
≤2.4.21Update to 2.4.22
- High7.5Authenticated Path Traversal
Ad Inserter – Ad Manager & AdSense Ads
≤2.4.19Update to 2.4.20
- Medium6.1Cross-Site Scripting
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤4.1.6Update to 4.1.7
- Critical9.8SQL Injection
FV Flowplayer Video Player
≤7.3.18.727Update to 7.3.19.727