CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1331)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.5 | Directory Traversal | CVE-2015-5472 | — | |
| High7.2 | Blind SQL Injection | CVE-2015-9462 | — | |
| High7.5 | Arbitrary File Download | CVE-2015-9463 | — | |
| High7.2 | Blind SQL Injection | CVE-2015-9461 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-5528 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9313 | — | |
| Medium6.1 | Unauthenticated Cross-Site Scripting | CVE-2015-3299 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2015-9460 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9312 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2015-9465 | — | |
| Critical9.8 | Unauthenticated Arbitrary File Upload | CVE-2015-9479 | — | |
| Medium6.1 | Open Redirect | CVE-2015-5461 | — | |
| High7.5 | Directory Traversal to Arbitrary File Access | CVE-2015-9464 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9466 | — | |
| High7.5 | Directory Traversal | CVE-2015-5468 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9467 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9468 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-9340 | — | |
| High7.5 | Directory Traversal | CVE-2015-5469 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-5681 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-5682 | — | |
| Critical9.1 | Path Traversal | CVE-2015-5609 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2015-9314 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-5057 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9342 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2015-9343 | — | |
| Critical9.8 | SQL Injection | CVE-2015-5599 | — | |
| High8.8 | Arbitrary Options Update | CVE-2015-9475 | — | |
| High7.5 | Directory Traversal | CVE-2015-4704 | — | |
| High8.8 | Fullscreen Photography Theme | Portfolio <= 1.8.5 - Arbitrary Options Update | CVE-2015-9476 | — |
- High7.5Directory Traversal
IBS Mappro
≤0.6Update to 1.0
- High7.2Blind SQL Injection
Awesome Filterable Portfolio
<1.9Update to 1.9
- High7.5Arbitrary File Download
S3Bubble Cloud Video with Adverts and Analytics
<4.8Update to 4.8
- High7.2Blind SQL Injection
Awesome Filterable Portfolio
<1.9Update to 1.9
- Medium6.1Cross-Site Scripting
Floating Social Bar
<1.1.7Update to 1.1.7
- Critical9.8SQL Injection
NewStatPress
<1.0.6Update to 1.0.6
- Medium6.1Unauthenticated Cross-Site Scripting
Floating Social Bar
≤1.1.6Update to 1.1.7
- High8.8Authenticated SQL Injection
Pinpoint Booking System – Legacy version
<2.1Update to 2.1
- Medium6.1Reflected Cross-Site Scripting
NewStatPress
<1.0.6Update to 1.0.6
- High8.8Authenticated SQL Injection
YASR – Yet Another Star Rating Plugin for WordPress
<0.9.1Update to 0.9.1
- Critical9.8Unauthenticated Arbitrary File Upload
acf-frontend-display
≤2.0.6No patch available
- Medium6.1Open Redirect
StageShow
<5.0.9Update to 5.0.9
- High7.5Directory Traversal to Arbitrary File Access
S3 Bubble Amazon S3 HTML5 Video with Adverts
≤0.7Update to 0.8
- Critical9.8SQL Injection
WTI Like Post
<1.4.3Update to 1.4.3
- High7.5Directory Traversal
WP eCommerce Shop Styling
<2.6Update to 2.6
- Critical9.8SQL Injection
Broken Link Manager
<0.5.0Update to 0.5.0
- Medium6.1Cross-Site Scripting
Broken Link Manager
≤0.4.5Update to 0.5.0
- Critical9.8Arbitrary File Upload
Iptanus File Upload
<3.0.0Update to 3.0.0
- High7.5Directory Traversal
MDC YouTube Downloader
<2.1.1Update to 2.1.1
- Critical9.8Arbitrary File Upload
Powerplay Gallery
≤3.3No patch available
- Critical9.8Arbitrary File Upload
Powerplay Gallery
≤3.3No patch available
- Critical9.1Path Traversal
Image Export
≤1.1Update to 1.1.1
- High7.2Stored Cross-Site Scripting
NewStatPress
≤1.0.3Update to 1.0.4
- Medium6.1Cross-Site Scripting
Broken Link Checker
<1.10.9Update to 1.10.9
- Medium6.1Cross-Site Scripting
WP Rollback – Rollback Plugins and Themes
<1.2.3Update to 1.2.3
- High8.8Cross-Site Request Forgery
WP Rollback – Rollback Plugins and Themes
<1.2.3Update to 1.2.3
- Critical9.8SQL Injection
Powerplay Gallery
≤3.3No patch available
- High8.8Arbitrary Options Update
Pont - Multipurpose Wordpress Theme | Business
≤1.5No patch available
- High7.5Directory Traversal
download-zip-attachments
≤1.0No patch available
- High8.8Fullscreen Photography Theme | Portfolio <= 1.8.5 - Arbitrary Options Update
Teardrop - Fullscreen Photography Theme | Portfolio
≤1.8.5Update to 1.8.6