CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1297)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | Arbitrary File Upload | CVE-2018-25436 | — | |
| Medium6.1 | Cross-Site Request Forgery | CVE-2019-1000003 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2024-51792 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-20462 | — | |
| Critical9.8 | SQL Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.3.21.1Update to 3.3.21.2 | CVE-2019-15025 | — | |
| High8.8 | SQL injection | CVE-2018-20556 | — | |
| Medium5.5 | Authenticated Cross-Site Scripting | CVE-2018-16204 | — | |
| High7.5 | Server-Side Request Forgery | CVE-2018-20463 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-20968 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-20231 | — | |
| Critical9.1 | Remote Code Execution | CVE-2018-20156 | — | |
| Medium5.5 | Cross-Site Scripting | CVE-2018-5668 | — | |
| Medium4.3 | Authorization Bypass WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20152 | — | |
| High7.5 | Sensitive Information Disclosure WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20151 | — | |
| High8.8 | PHP Object Injection WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20148 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting via Comments WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20153 | — | |
| Medium6.4 | Stored Cross-Site Scripting via File Uploads WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20149 | — | |
| High7.7 | Arbitrary File Deletion WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20147 | — | |
| Medium6.1 | WordPress Core < 5.0.1 Reflected Cross-Site Scripting WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20150 | — | |
| High7.5 | Arbitrary File Read | CVE-2019-15330 | — | |
| Medium6.1 | Import Cross-Site Scripting | CVE-2018-20101 | — | |
| Medium5.4 | Author+ Stored Cross-Site Scripting | CVE-2018-20986 | — | |
| Critical9.8 | Local File Inclusion | CVE-2018-20985 | — | |
| High8.8 | Authenticated SQL Injection via Settings Import | CVE-2019-15872 | — | |
| High8.8 | Unauthenticated Arbitrary Password Reset | CVE-2018-19488 | — | |
| Medium5.3 | User Enumeration | CVE-2018-19487 | — | |
| Medium4.7 | Authenticated Open Redirect Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.3.19Update to 3.3.19.1 | CVE-2018-19796 | — | |
| Critical9.8 | Improper Access Control | CVE-2018-21007 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2018-19564 | — | |
| Critical9.8 | PHP Object Injection | CVE-2018-20984 | — |
- Critical9.8Arbitrary File Upload
Baggage Freight Shipping Australia
≤0.1.0No patch available
- Medium6.1Cross-Site Request Forgery
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
<3.3.0Update to 3.3.0
- Critical9.8Arbitrary File Upload
Audio Record
≤1.0No patch available
- Medium6.1Cross-Site Scripting
JSmol2WP
≤1.07No patch available
- Critical9.8SQL Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.3.21.1Update to 3.3.21.2
- High8.8SQL injection
Booking Calendar
≤8.4.3Update to 8.4.4
- Medium5.5Authenticated Cross-Site Scripting
XML Sitemap Generator for Google
≤4.0.9Update to 4.1.0
- High7.5Server-Side Request Forgery
JSmol2WP
≤1.07No patch available
- High8.8Cross-Site Request Forgery
Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export
<1.4.2Update to 1.4.2
- High8.8Cross-Site Request Forgery
Two Factor Authentication
<1.3.13Update to 1.3.13
- Critical9.1Remote Code Execution
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<2.0.7Update to 2.0.7
- Medium5.5Cross-Site Scripting
Read and Understood
<2.2Update to 2.2
- Medium4.3Authorization Bypass
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- High7.5Sensitive Information Disclosure
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- High8.8PHP Object Injection
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.4Authenticated Stored Cross-Site Scripting via Comments
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.4Stored Cross-Site Scripting via File Uploads
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- High7.7Arbitrary File Deletion
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.1WordPress Core < 5.0.1 Reflected Cross-Site Scripting
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- High7.5Arbitrary File Read
WebP Express
<0.14.11Update to 0.14.11
- Medium6.1Import Cross-Site Scripting
Import and export users and customers
<1.12.1Update to 1.12.1
- Medium5.4Author+ Stored Cross-Site Scripting
Advanced Custom Fields (ACF®)
<5.7.8Update to 5.7.8
- Critical9.8Local File Inclusion
WP Payeezy Pay
<2.98Update to 2.98
- High8.8Authenticated SQL Injection via Settings Import
LoginPress | wp-login Custom Login Page Customizer
<1.1.16Update to 1.1.16
- High8.8Unauthenticated Arbitrary Password Reset
WP JobHunt
<2.4Update to 2.4
- Medium5.3User Enumeration
WP JobHunt
<2.4Update to 2.4
- Medium4.7Authenticated Open Redirect
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.3.19Update to 3.3.19.1
- Critical9.8Improper Access Control
User Email Verification for WooCommerce
≤3.1.15Update to 3.2.0
- Medium6.1Stored Cross-Site Scripting
Easy Testimonials
<3.6Update to 3.6
- Critical9.8PHP Object Injection
Patreon WordPress
<1.2.2Update to 1.2.2