CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1330)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.5 | Arbitrary File Download | CVE-2015-1000007 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9452 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9451 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9453 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9450 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2015-9454 | — | |
| High7.2 | Local File Includion | CVE-2015-10133 | — | |
| High7.1 | Multiple Cross-Site Scripting | CVE-2015-2973 | — | |
| High7.5 | Arbitrary File Download | CVE-2015-20067 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2015-9455 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2015-5484 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2015-9347 | — | |
| High7.5 | Directory Traversal | CVE-2015-1000006 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-5485 | — | |
| Medium5.3 | Full Path Disclosure | CVE-2015-1000008 | — | |
| High7.5 | Arbitrary File Download | CVE-2015-1000005 | — | |
| Critical9.8 | Blind SQL Injection | CVE-2015-1000003 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-1000004 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2016-1000156 | — | |
| High7.5 | Improper Input Validation | CVE-2015-9348 | — | |
| High7.2 | Directory Traversal | CVE-2015-5482 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2015-9233 | — | |
| High7.2 | SQL Injection | CVE-2015-9234 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-1000000 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-5481 | — | |
| Medium5.3 | Directory Traversal | CVE-2015-5471 | — | |
| High7.5 | Directory Traversal | CVE-2015-5472 | — | |
| Medium6.5 | Arbitrary File Write | CVE-2015-9456 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9459 | — | |
| High7.2 | SQL Injection | CVE-2015-9457 | — |
- High7.5Arbitrary File Download
wptf-image-gallery
≤1.0.3No patch available
- Critical9.8SQL Injection
NEX-Forms – Ultimate Forms Plugin for WordPress
<4.6.1Update to 4.6.1
- Critical9.8SQL Injection
Plugmatter Optin Feature Box
<2.0.14Update to 2.0.14
- Medium6.1Cross-Site Scripting
Broken Link Manager
<0.6.0Update to 0.6.0
- Critical9.8SQL Injection
Plugmatter Optin Feature Box
<2.0.14Update to 2.0.14
- High8.8Authenticated SQL Injection
Smooth Slider
≤2.6.5Update to 2.7
- High7.2Local File Includion
Subscribe to Comments
≤2.1.2Update to 2.3
- High7.1Multiple Cross-Site Scripting
Welcart e-Commerce
<1.4.18Update to 1.4.18
- High7.5Arbitrary File Download
WP Attachment Export
<0.2.4Update to 0.2.4
- High8.8Cross-Site Request Forgery
BuddyPress Activity Plus
≤1.5Update to 1.6.2
- Medium6.4Stored Cross-Site Scripting
Plotly
<1.0.3Update to 1.0.3
- Medium6.4Stored Cross-Site Scripting
Plotly
≤1.0.2Update to 1.0.3
- High7.5Directory Traversal
Recent Backups
≤0.7No patch available
- Medium6.1Cross-Site Scripting
The Events Calendar: Eventbrite Tickets
<3.10.2Update to 3.10.2
- Medium5.3Full Path Disclosure
MP3-jPlayer
<2.5Update to 2.5
- High7.5Arbitrary File Download
candidate-application-form
≤1.3No patch available
- Critical9.8Blind SQL Injection
filedownload
<1.4Update to 1.4
- Medium6.1Cross-Site Scripting
filedownload
≤1.4Update to 2.0
- Critical9.8Arbitrary File Upload
MailCWP
≤1.100No patch available
- High7.5Improper Input Validation
Sell Downloads
<1.0.8Update to 1.0.8
- High7.2Directory Traversal
forumAttachments for bbPress
<2.3Update to 2.3
- High8.8Cross-Site Request Forgery
CP Contact Form with PayPal
<1.1.6Update to 1.1.6
- High7.2SQL Injection
CP Contact Form with PayPal
<1.1.6Update to 1.1.6
- Critical9.8Arbitrary File Upload
MailCWP
≤1.100Update to 1.110
- Medium6.1Reflected Cross-Site Scripting
forumAttachments for bbPress
<2.3Update to 2.3
- Medium5.3Directory Traversal
Swim Team
≤1.44.1077Update to 1.45.1085
- High7.5Directory Traversal
IBS Mappro
≤0.6Update to 1.0
- Medium6.5Arbitrary File Write
Child Theme Creator by Orbisius
<1.2.8Update to 1.2.8
- Medium6.1Reflected Cross-Site Scripting
SEO SearchTerms Tagging 2
≤1.535No patch available
- High7.2SQL Injection
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
<1.6.8Update to 1.6.8