CWE-862Vulnerability type

WordPress Missing Authorization vulnerabilities (page 1321)

AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Missing Authorization vulnerabilities (page 1321)
Severity	Vulnerability	CVE	Installs	Published
Critical9.8	SQL Injection Kento Post View Counter≤2.8No patch available	CVE-2016-15040	—	May 26, 2016
Medium6.1	Stored Cross-Site Scripting Markdown on Save Improved≤2.5Update to 2.5.1	CVE-2016-4812	—	May 25, 2016
Medium6.1	Stored Cross-Site Scripting Markdown on Save Improved≤2.5No patch available	CVE-2017-9337	—	May 25, 2016
Medium6.1	Reflected Cross-Site Scripting Brafton<3.4.8Update to 3.4.8	CVE-2016-10973	—	May 20, 2016
High8.8	Cross-Site Request Forgery Fluid Responsive Slideshow<2.2.7Update to 2.2.7	CVE-2016-10974	—	May 18, 2016
Medium6.1	Reflected Cross-Site Scripting Fluid Responsive Slideshow<2.2.7Update to 2.2.7	CVE-2016-10975	—	May 18, 2016
High8.1	2.9.42 - PHP Object Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder2.9.36 – 2.9.42Update to 2.9.42.1	CVE-2016-1209	—	May 13, 2016
High8.8	Cross-Site Request Forgery WP Editor<1.2.6Update to 1.2.6	CVE-2016-10885	—	May 13, 2016
Medium6.5	Directory Traversal Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization≤4.4.4Update to 4.5.0	CVE-2016-10977	—	May 10, 2016
Critical9.8	SQL Injection Image Gallery - Responsive Photo Gallery≤1.8.9Update to 1.9.0	CVE-2016-11018	—	May 10, 2016
Medium6.1	Cross-Site Scripting Crayon Syntax Highlighter<2.8.4Update to 2.8.4	CVE-2016-10893	—	May 10, 2016
Medium6.4	Authenticated Stored Cross-Site Scripting Royal PrettyPhoto≤1.2Update to 1.3	CVE-2015-10128	—	May 9, 2016
High7.2	Cross-Site Scripting Safe Editor<1.2Update to 1.2	CVE-2016-10976	—	May 6, 2016
Medium6.1	Cross-Site Scripting via plupload.flash.swf WordPress≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2	CVE-2016-4566	—	May 6, 2016
Medium6.4	Cross-Site Scripting via MediaElement.js WordPress≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2	CVE-2016-4567	—	May 6, 2016
Medium6.1	Reflected Cross-Site Scripting Truemagall versionsNo patch available	CVE-2016-10994	—	Apr 29, 2016
High7.2	Stored Cross-Site Scripting MainWP Dashboard: Self-hosted WordPress Management for Agencies<3.1.3Update to 3.1.3	CVE-2016-15041	—	Apr 29, 2016
High7.5	Missing Authorization Checks Ghost≤0.5.5Update to 0.5.6	CVE-2016-10983	—	Apr 28, 2016
Medium6.1	Cross-Site Scripting GNUCommerce<0.5.7-betaUpdate to 0.5.7-beta	CVE-2016-10920	—	Apr 26, 2016
Medium6.1	Multiple Cross-Site Scripting Sermon Browser≤0.45.15Update to 0.45.16	CVE-2016-10897	—	Apr 26, 2016
Critical9.8	Arbitrary File Upload Tevolution<2.3.0Update to 2.3.0	CVE-2016-10995	—	Apr 23, 2016
Medium6.1	Reflected Cross-Site Scripting Echo Sign<1.2Update to 1.2	CVE-2016-10984	—	Apr 21, 2016
Medium6.1	Reflected Cross-Site Scripting Tweet Wheel<1.0.3.3Update to 1.0.3.3	CVE-2016-10986	—	Apr 21, 2016
Medium6.1	Cross-Site Scripting افزونه پیامک ووکامرس \| Persian WooCommerce SMS≤3.3.2Update to 3.3.3	CVE-2016-10987	—	Apr 21, 2016
Medium6.1	Reflected Cross-Site Scripting Echo Sign<1.2Update to 1.2	CVE-2016-10985	—	Apr 21, 2016
Medium6.1	Cross-Site Scripting Translate WordPress – Google Language Translator<5.0.06Update to 5.0.06	CVE-2016-10870	—	Apr 18, 2016
Medium5.4	Stored Cross-Site Scripting leenk.me<2.6.0Update to 2.6.0	CVE-2016-10988	—	Apr 17, 2016
Medium6.1	Stored Cross-Site Scripting Kento Post View Counter≤2.8No patch available	CVE-2016-10981	—	Apr 17, 2016
High8.8	Cross-Site Request Forgery Kento Post View Counter≤2.8No patch available	CVE-2016-10982	—	Apr 17, 2016
High8.8	Cross-Site Request Forgery leenk.me≤2.5.0Update to 2.6.0	CVE-2016-10989	—	Apr 16, 2016

Critical9.8
SQL Injection
Kento Post View Counter
≤2.8No patch available
CVE-2016-15040May 26, 2016
Medium6.1
Stored Cross-Site Scripting
Markdown on Save Improved
≤2.5Update to 2.5.1
CVE-2016-4812May 25, 2016
Medium6.1
Stored Cross-Site Scripting
Markdown on Save Improved
≤2.5No patch available
CVE-2017-9337May 25, 2016
Medium6.1
Reflected Cross-Site Scripting
Brafton
<3.4.8Update to 3.4.8
CVE-2016-10973May 20, 2016
High8.8
Cross-Site Request Forgery
Fluid Responsive Slideshow
<2.2.7Update to 2.2.7
CVE-2016-10974May 18, 2016
Medium6.1
Reflected Cross-Site Scripting
Fluid Responsive Slideshow
<2.2.7Update to 2.2.7
CVE-2016-10975May 18, 2016
High8.1
2.9.42 - PHP Object Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
2.9.36 – 2.9.42Update to 2.9.42.1
CVE-2016-1209May 13, 2016
High8.8
Cross-Site Request Forgery
WP Editor
<1.2.6Update to 1.2.6
CVE-2016-10885May 13, 2016
Medium6.5
Directory Traversal
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
≤4.4.4Update to 4.5.0
CVE-2016-10977May 10, 2016
Critical9.8
SQL Injection
Image Gallery - Responsive Photo Gallery
≤1.8.9Update to 1.9.0
CVE-2016-11018May 10, 2016
Medium6.1
Cross-Site Scripting
Crayon Syntax Highlighter
<2.8.4Update to 2.8.4
CVE-2016-10893May 10, 2016
Medium6.4
Authenticated Stored Cross-Site Scripting
Royal PrettyPhoto
≤1.2Update to 1.3
CVE-2015-10128May 9, 2016
High7.2
Cross-Site Scripting
Safe Editor
<1.2Update to 1.2
CVE-2016-10976May 6, 2016
Medium6.1
Cross-Site Scripting via plupload.flash.swf
WordPress
≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2
CVE-2016-4566May 6, 2016
Medium6.4
Cross-Site Scripting via MediaElement.js
WordPress
≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2
CVE-2016-4567May 6, 2016
Medium6.1
Reflected Cross-Site Scripting
Truemag
all versionsNo patch available
CVE-2016-10994Apr 29, 2016
High7.2
Stored Cross-Site Scripting
MainWP Dashboard: Self-hosted WordPress Management for Agencies
<3.1.3Update to 3.1.3
CVE-2016-15041Apr 29, 2016
High7.5
Missing Authorization Checks
Ghost
≤0.5.5Update to 0.5.6
CVE-2016-10983Apr 28, 2016
Medium6.1
Cross-Site Scripting
GNUCommerce
<0.5.7-betaUpdate to 0.5.7-beta
CVE-2016-10920Apr 26, 2016
Medium6.1
Multiple Cross-Site Scripting
Sermon Browser
≤0.45.15Update to 0.45.16
CVE-2016-10897Apr 26, 2016
Critical9.8
Arbitrary File Upload
Tevolution
<2.3.0Update to 2.3.0
CVE-2016-10995Apr 23, 2016
Medium6.1
Reflected Cross-Site Scripting
Echo Sign
<1.2Update to 1.2
CVE-2016-10984Apr 21, 2016
Medium6.1
Reflected Cross-Site Scripting
Tweet Wheel
<1.0.3.3Update to 1.0.3.3
CVE-2016-10986Apr 21, 2016
Medium6.1
Cross-Site Scripting
افزونه پیامک ووکامرس | Persian WooCommerce SMS
≤3.3.2Update to 3.3.3
CVE-2016-10987Apr 21, 2016
Medium6.1
Reflected Cross-Site Scripting
Echo Sign
<1.2Update to 1.2
CVE-2016-10985Apr 21, 2016
Medium6.1
Cross-Site Scripting
Translate WordPress – Google Language Translator
<5.0.06Update to 5.0.06
CVE-2016-10870Apr 18, 2016
Medium5.4
Stored Cross-Site Scripting
leenk.me
<2.6.0Update to 2.6.0
CVE-2016-10988Apr 17, 2016
Medium6.1
Stored Cross-Site Scripting
Kento Post View Counter
≤2.8No patch available
CVE-2016-10981Apr 17, 2016
High8.8
Cross-Site Request Forgery
Kento Post View Counter
≤2.8No patch available
CVE-2016-10982Apr 17, 2016
High8.8
Cross-Site Request Forgery
leenk.me
≤2.5.0Update to 2.6.0
CVE-2016-10989Apr 16, 2016