CWE-862Vulnerability type

WordPress Missing Authorization vulnerabilities (page 1299)

AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Missing Authorization vulnerabilities (page 1299)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Cross-Site Scripting via rules[0][content] parameter WP Fastest Cache – WordPress Cache Plugin≤0.8.8.5Update to 0.8.8.6	CVE-2018-17586	—	Oct 9, 2018
Medium6.1	Cross-Site Scripting via wpFastestCachePage options, wpFastestCachePreload_number or wpFastestCacheLanguage parameter WP Fastest Cache – WordPress Cache Plugin≤0.8.8.5Update to 0.8.8.6	CVE-2018-17585	—	Oct 9, 2018
High7.2	Unauthenticated Stored Cross-Site Scripting WPML Multilingual CMS≤3.6.3Update to 4.0	CVE-2018-18069	—	Oct 8, 2018
Medium6.1	Multiple Cross-Site Scripting vulnerabilities Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin≤2.0.27Update to 2.0.28	CVE-2018-17866	—	Oct 6, 2018
Medium6.1	Cross-Site Scripting Slideshow Gallery LITE≤1.6.8Update to 1.6.9	CVE-2018-18019	—	Oct 4, 2018
High7.2	SQL Injection Slideshow Gallery LITE≤1.6.8Update to 1.6.9	CVE-2018-18018	—	Oct 4, 2018
Medium6.1	Cross-Site Scripting Slideshow Gallery LITE≤1.6.8Update to 1.6.9	CVE-2018-18017	—	Oct 4, 2018
High8.8	Cross-Site Request Forgery Companion Auto Update<3.2.1Update to 3.2.1	CVE-2018-20972	—	Oct 2, 2018
Critical9.8	Local File Inclusion Companion Auto Update<3.2.1Update to 3.2.1	CVE-2018-20973	—	Oct 1, 2018
Medium6.1	Stored Cross-Site Scripting WebARX≤1.3.0No patch available	CVE-2019-17213	—	Sep 27, 2018
Critical9.8	Arbitrary File Upload Wp-Insert≤2.4.2Update to 2.4.3	CVE-2018-17573	—	Sep 27, 2018
High7.5	Firewall Bypass WebARX≤1.3.0No patch available	CVE-2019-17214	—	Sep 27, 2018
High7.5	Directory Traversal Localize My Post≤1.0No patch available	CVE-2018-16299	—	Sep 19, 2018
Critical9.8	Directory Traversal 微信群发助手-Wechat Broadcast≤1.2.0No patch available	CVE-2018-16283	—	Sep 19, 2018
Medium6.1	Reflected Cross-Site Scripting Arigato Autoresponder and Newsletter≤2.5.1.8Update to 2.5.1.9	CVE-2018-1002007	—	Sep 18, 2018
Medium6.1	Reflected Cross-Site Scripting Arigato Autoresponder and Newsletter≤2.5.1.8Update to 2.5.1.9	CVE-2018-1002001	—	Sep 18, 2018
Medium4.8	Cross-Site Scripting Arigato Autoresponder and Newsletter≤2.5.1.8Update to 2.5.1.9	CVE-2018-1002005	—	Sep 18, 2018
Medium4.8	Cross-Site Scripting Arigato Autoresponder and Newsletter≤2.5.1.8Update to 2.5.1.9	CVE-2018-1002006	—	Sep 18, 2018
Medium6.1	Reflected Cross-Site Scripting Arigato Autoresponder and Newsletter≤2.5.1.8Update to 2.5.1.9	CVE-2018-1002004	—	Sep 18, 2018
High7.2	SQL Injection Arigato Autoresponder and Newsletter≤2.5.1.8Update to 2.5.1.9	CVE-2018-1002000	—	Sep 18, 2018
Medium6.1	Reflected Cross-Site Scripting Arigato Autoresponder and Newsletter≤2.5.1.8Update to 2.5.1.9	CVE-2018-1002003	—	Sep 18, 2018
Medium6.1	Reflected Cross-Site Scripting Arigato Autoresponder and Newsletter≤2.5.1.8Update to 2.5.1.9	CVE-2018-1002008	—	Sep 18, 2018
Medium6.1	Reflected Cross-Site Scripting Arigato Autoresponder and Newsletter≤2.5.1.8Update to 2.5.1.9	CVE-2018-1002009	—	Sep 18, 2018
Medium6.1	Reflected Cross-Site Scripting Arigato Autoresponder and Newsletter≤2.5.1.8Update to 2.5.1.9	CVE-2018-1002002	—	Sep 18, 2018
Medium6.1	Stored Cross-Site Scripting File Manager≤3.0Update to 3.1	CVE-2018-16967	1M+	Sep 17, 2018
High8.8	Cross-Site Request Forgery File Manager≤3.0Update to 3.1	CVE-2018-16966	1M+	Sep 17, 2018
Critical9.8	Unauthenticated Arbitrary File Upload/Download File Manager≤3.0Update to 3.1	CVE-2018-25105	1M+	Sep 17, 2018
Medium6.1	Reflected Cross-Site Scripting File Manager<3.0Update to 3.0	CVE-2018-16363	1M+	Sep 6, 2018
Critical9.8	Privilege Escalation wpForo Forum≤1.5.1Update to 1.5.2	CVE-2018-16613	—	Sep 6, 2018
High7.5	PHAR Unserialization WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1	CVE-2018-1000773	—	Sep 6, 2018

Medium6.1
Cross-Site Scripting via rules[0][content] parameter
WP Fastest Cache – WordPress Cache Plugin
≤0.8.8.5Update to 0.8.8.6
CVE-2018-17586Oct 9, 2018
Medium6.1
Cross-Site Scripting via wpFastestCachePage options, wpFastestCachePreload_number or wpFastestCacheLanguage parameter
WP Fastest Cache – WordPress Cache Plugin
≤0.8.8.5Update to 0.8.8.6
CVE-2018-17585Oct 9, 2018
High7.2
Unauthenticated Stored Cross-Site Scripting
WPML Multilingual CMS
≤3.6.3Update to 4.0
CVE-2018-18069Oct 8, 2018
Medium6.1
Multiple Cross-Site Scripting vulnerabilities
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.27Update to 2.0.28
CVE-2018-17866Oct 6, 2018
Medium6.1
Cross-Site Scripting
Slideshow Gallery LITE
≤1.6.8Update to 1.6.9
CVE-2018-18019Oct 4, 2018
High7.2
SQL Injection
Slideshow Gallery LITE
≤1.6.8Update to 1.6.9
CVE-2018-18018Oct 4, 2018
Medium6.1
Cross-Site Scripting
Slideshow Gallery LITE
≤1.6.8Update to 1.6.9
CVE-2018-18017Oct 4, 2018
High8.8
Cross-Site Request Forgery
Companion Auto Update
<3.2.1Update to 3.2.1
CVE-2018-20972Oct 2, 2018
Critical9.8
Local File Inclusion
Companion Auto Update
<3.2.1Update to 3.2.1
CVE-2018-20973Oct 1, 2018
Medium6.1
Stored Cross-Site Scripting
WebARX
≤1.3.0No patch available
CVE-2019-17213Sep 27, 2018
Critical9.8
Arbitrary File Upload
Wp-Insert
≤2.4.2Update to 2.4.3
CVE-2018-17573Sep 27, 2018
High7.5
Firewall Bypass
WebARX
≤1.3.0No patch available
CVE-2019-17214Sep 27, 2018
High7.5
Directory Traversal
Localize My Post
≤1.0No patch available
CVE-2018-16299Sep 19, 2018
Critical9.8
Directory Traversal
微信群发助手-Wechat Broadcast
≤1.2.0No patch available
CVE-2018-16283Sep 19, 2018
Medium6.1
Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
CVE-2018-1002007Sep 18, 2018
Medium6.1
Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
CVE-2018-1002001Sep 18, 2018
Medium4.8
Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
CVE-2018-1002005Sep 18, 2018
Medium4.8
Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
CVE-2018-1002006Sep 18, 2018
Medium6.1
Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
CVE-2018-1002004Sep 18, 2018
High7.2
SQL Injection
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
CVE-2018-1002000Sep 18, 2018
Medium6.1
Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
CVE-2018-1002003Sep 18, 2018
Medium6.1
Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
CVE-2018-1002008Sep 18, 2018
Medium6.1
Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
CVE-2018-1002009Sep 18, 2018
Medium6.1
Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
CVE-2018-1002002Sep 18, 2018
Medium6.1
Stored Cross-Site Scripting
File Manager
≤3.0Update to 3.1
CVE-2018-169671M+Sep 17, 2018
High8.8
Cross-Site Request Forgery
File Manager
≤3.0Update to 3.1
CVE-2018-169661M+Sep 17, 2018
Critical9.8
Unauthenticated Arbitrary File Upload/Download
File Manager
≤3.0Update to 3.1
CVE-2018-251051M+Sep 17, 2018
Medium6.1
Reflected Cross-Site Scripting
File Manager
<3.0Update to 3.0
CVE-2018-163631M+Sep 6, 2018
Critical9.8
Privilege Escalation
wpForo Forum
≤1.5.1Update to 1.5.2
CVE-2018-16613Sep 6, 2018
High7.5
PHAR Unserialization
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
CVE-2018-1000773Sep 6, 2018