CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1322)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery
leenk.me
≤2.5.0Update to 2.6.0
- Medium6.1Reflected Cross-Site Scripting
Defa Online Image Protector Free Edition
≤3.4No patch available
- Medium6.1Reflected Cross-Site Scripting
WPSOLR – Elasticsearch and Solr search
≤8.6Update to 8.7
- Medium6.4Cross-Site Scripting via Network Settings Page
WordPress
<4.5Update to 4.5
- Medium6.1Reflected Cross-Site Scripting
S3 Video Plugin
≤0.983No patch available
- Medium6.1Reflected Cross-Site Scripting
MW Font Changer
<4.3Update to 4.3
- Medium6.1Reflected Cross-Site Scripting
Hero Maps Pro
≤2.1.0Update to 2.2.0
- Medium6.1Reflected Cross-Site Scripting
MiniMax – Page Layout Builder
≤1.9.3No patch available
- High8.8Cross-Site Request Forgery
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
≤4.3Update to 4.3.1
- Medium6.1Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<1.3.40Update to 1.3.40
- Medium6.1Reflected Cross-Site Scripting
Post Duplicator
≤2.16Update to 2.17
- Critical9.8SQL Injection
All-In-One Security (AIOS) – Security and Firewall
<4.0.7Update to 4.0.7
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Lightbox Plus
≤2.7.2No patch available
- Medium6.1Cross-Site Scripting
WP Customer Reviews
<3.0.9Update to 3.0.9
- Medium6.1Cross-Site Scripting
ScoreMe
≤2016-04-01No patch available
- High7.2Stored Cross-Site Scripting
WP Cerber Security, Anti-spam & Malware Scan
<2.7Update to 2.7
- High7.5Directory Traversal
Zedna eBook download
<1.2Update to 1.2
- Medium6.1Unauthenticated Cross-Site Scripting
WP Favorite Posts
≤1.6.5Update to 1.6.6
- Medium6.1Cross-Site Scripting
Music Store – WordPress eCommerce
≤1.0.41Update to 1.0.43
- High7.5Local File Inclusion
IMDB Profile Widget
<1.0.9Update to 1.0.9
- High8.1Unauthenticated Local File Inclusion
Issuu Panel
<1.6.6No patch available
- High7.5Arbitrary File Download
Memphis Documents Library
≤3.1.5Update to 3.1.6
- Critical9.8Local File Inclusion
A/B Test for WordPress
≤1.0.7No patch available
- High8.8Cross-Site Request Forgery via wp_ajax_wp_compression_test
WordPress
<4.5Update to 4.5
- High8.8Cross-Site Request Forgery & Arbitrary File Upload
Beauty & Clean
≤1.0.8No patch available
- Medium6.1Cross-Site Scripting
Ocim MP3
all versionsNo patch available
- Medium6.1Reflected Cross-Site Scripting
Shibboleth
≤1.6Update to 1.7
- Medium6.1Reflected Cross-Site Scripting
Forget About Shortcode Buttons
≤1.1.1Update to 1.1.2
- Medium6.1Reflected Cross-Site Scripting
Goodnews – Responsive WordPress News/Magazine | News / Editorial
≤5.11.1No patch available
- Critical9.8SQL Injection
Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export
≤1.1Update to 1.2