CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1316)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-9288 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18541 | — | |
| Critical9.8 | SQL Injection | CVE-2017-18548 | — | |
| High7.3 | Arbitrary Page Modification WordPress≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2 | CVE-2017-1001000 | — | |
| Medium6.1 | Cross-Site Scripting WordPress≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2 | CVE-2017-5612 | — | |
| Medium4.3 | Authorization Bypass to Term Disclosure WordPress≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2 | CVE-2017-5610 | — | |
| High8.8 | Authenticated SQL Injection WordPress≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2 | CVE-2017-5611 | — | |
| Critical9.8 | Unauthenticated PHP Object Injection | CVE-2016-15004 | — | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting | CVE-2017-20177 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18526 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18576 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18536 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18612 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10892 | — | |
| High8.8 | Cross-Site Request Forgery via Uploading Flash File WordPress≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5489 | — | |
| High8.8 | Cross-Site Request Forgery via Widget Editing WordPress≤4.7Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5492 | — | |
| Medium4.3 | Information Disclosure WordPress≤4.7Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5487 | — | |
| Medium5.3 | Weak Multi-Site Activation Key for User and Site Signup WordPress≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5493 | — | |
| High8.3 | Authorization Bypass WordPress≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5491 | — | |
| Medium5.5 | Cross-Site Scripting via Name and Version Header of Plugin WordPress≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5488 | — | |
| Medium5.5 | Stored Cross-Site Scripting via theme directory name WordPress≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5490 | — | |
| Critical9.9 | Local File Inclusion | CVE-2017-20289 | — | |
| Medium4.3 | Path Disclosure WordPress≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2 | CVE-2017-6514 | — | |
| High7.2 | Server-Side Request Forgery | CVE-2016-10927 | — | |
| Medium5.4 | Missing Authorization & Cross-Site Request Forgery | CVE-2016-10938 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2016-10940 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2016-10943 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2016-10939 | — | |
| High8.8 | Cross-Site Request Forgery to Stored Cross-Site Scripting | CVE-2016-11085 | — | |
| High8.8 | SQL Injection | CVE-2016-10942 | — |
- Medium6.1Reflected Cross-Site Scripting
Raygun
≤1.8.0Update to 1.8.1
- Medium6.1Cross-Site Scripting
XO Security
<1.5.3Update to 1.5.3
- Critical9.8SQL Injection
Note Press
<0.1.2Update to 0.1.2
- High7.3Arbitrary Page Modification
WordPress
≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2
- Medium6.1Cross-Site Scripting
WordPress
≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2
- Medium4.3Authorization Bypass to Term Disclosure
WordPress
≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2
- High8.8Authenticated SQL Injection
WordPress
≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2
- Critical9.8Unauthenticated PHP Object Injection
InfiniteWP Client
<1.6.1.1Update to 1.6.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
WangGuard
<1.8.0Update to 1.8.0
- Medium6.1Cross-Site Scripting
moreAds SE
≤1.4.6Update to 1.4.7
- Medium6.1Cross-Site Scripting
Event Notifier
≤1.2.0Update to 1.2.1
- Medium6.1Cross-Site Scripting
Stop User Enumeration
<1.3.8Update to 1.3.8
- Medium6.1Reflected Cross-Site Scripting
WP Whois Domain
≤1.0.0No patch available
- Medium6.1Cross-Site Scripting
Chained Quiz
<1.0Update to 1.0
- High8.8Cross-Site Request Forgery via Uploading Flash File
WordPress
≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- High8.8Cross-Site Request Forgery via Widget Editing
WordPress
≤4.7Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- Medium4.3Information Disclosure
WordPress
≤4.7Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- Medium5.3Weak Multi-Site Activation Key for User and Site Signup
WordPress
≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- High8.3Authorization Bypass
WordPress
≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- Medium5.5Cross-Site Scripting via Name and Version Header of Plugin
WordPress
≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- Medium5.5Stored Cross-Site Scripting via theme directory name
WordPress
≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- Critical9.9Local File Inclusion
Ad Widget for WordPress
<2.12.0Update to 2.12.0
- Medium4.3Path Disclosure
WordPress
≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2
- High7.2Server-Side Request Forgery
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
<4.5.11Update to 4.5.11
- Medium5.4Missing Authorization & Cross-Site Request Forgery
copy-me
≤1.0.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
ZM Gallery
≤1.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
ZX_CSV Upload
≤1No patch available
- High7.2Authenticated (Admin+) SQL Injection
Xtreme Locator
≤3.0.1No patch available
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
<4.7.9Update to 4.7.9
- High8.8SQL Injection
Podlove Podcast Publisher
<2.3.16Update to 2.3.16