CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1333)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | Arbitrary File Upload | CVE-2015-9471 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-4139 | — | |
| Medium6.1 | Open Redirect | CVE-2015-4070 | — | |
| Medium6.1 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2015-4140 | — | |
| High8.8 | SQL Injection | CVE-2014-5183 | — | |
| Critical9.8 | SQL Injection | CVE-2015-2090 | — | |
| Medium5.8 | Open Proxy | CVE-2015-4339 | — | |
| High8.8 | Multiple Cross-Site Request Forgery | CVE-2015-4089 | — | |
| High8.8 | SQL Injection | CVE-2015-4066 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2015-4062 | — | |
| Medium5.4 | Authenticated Cross-Site Scripting | CVE-2015-4063 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2015-4064 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-10131 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2015-4084 | — | |
| Medium6.5 | Cross-Site Scripting | CVE-2015-4065 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9300 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2015-4127 | — | |
| High8.8 | Privilege Escalation | CVE-2015-4038 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2015-4039 | — | |
| Medium6.1 | Reflecte Cross-Site Scripting | CVE-2015-10095 | — | |
| High7.2 | Authenticated (Admin+) Remote Code Execution | CVE-2015-3173 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9346 | — | |
| High7.1 | Cross-Site Scripting | CVE-2015-3647 | — | |
| Critical9.8 | SQL Injection | CVE-2015-4018 | — | |
| High7.5 | Arbitrary File Download via Path Traversal | CVE-2015-10134 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-5034 | — | |
| High7.5 | Sensitive Information Disclosure | CVE-2015-9491 | — | |
| High7.5 | Sensitive Information Disclosure | CVE-2015-9489 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9317 | — | |
| High7.5 | Sensitive Information Disclosure | CVE-2015-9487 | — |
- Critical9.8Arbitrary File Upload
ZoomSounds - WordPress Wave Audio Player with Playlist
<3.0Update to 3.0
- Medium6.1Cross-Site Scripting
wp-smiley
≤1.4.1No patch available
- Medium6.1Open Redirect
Wow Moodboard Lite
≤1.1.1.1No patch available
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
wp-smiley
≤1.4.1No patch available
- High8.8SQL Injection
Simple Retail Menus
≤4.0.1Update to 4.1
- Critical9.8SQL Injection
WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress
<1.2Update to 1.2
- Medium5.8Open Proxy
Gmedia Photo Gallery
<1.6.5Update to 1.6.5
- High8.8Multiple Cross-Site Request Forgery
WP Fastest Cache – WordPress Cache Plugin
<0.8.3.5Update to 0.8.3.5
- High8.8SQL Injection
GigPress
<2.3.9Update to 2.3.9
- High8.8Authenticated SQL Injection
NewStatPress
≤0.9.8Update to 0.9.9
- Medium5.4Authenticated Cross-Site Scripting
NewStatPress
≤0.9.8Update to 0.9.9
- High8.8Authenticated SQL Injection
WordPress Landing Pages
<1.8.5Update to 1.8.5
- Medium6.1Reflected Cross-Site Scripting
TFO Graphviz
≤1.9Update to 1.10
- High7.2Stored Cross-Site Scripting
Free counter
≤1.1Update to 1.2
- Medium6.5Cross-Site Scripting
WordPress Landing Pages
<1.8.5Update to 1.8.5
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.5.7Update to 5.5.7
- Medium6.1Stored Cross-Site Scripting
Church Admin
<0.810Update to 0.810
- High8.8Privilege Escalation
WP Membership
≤1.2.3No patch available
- Medium5.4Cross-Site Scripting
WP Membership
≤1.2.3No patch available
- Medium6.1Reflecte Cross-Site Scripting
woo-popup
≤1.2.2Update to 1.3.0
- High7.2Authenticated (Admin+) Remote Code Execution
Custom Content Type Manager
≤0.9.8.5Update to 0.9.8.6
- Medium6.1Cross-Site Scripting
Polls CP
<1.0.5Update to 1.0.5
- High7.1Cross-Site Scripting
WP Photo Album Plus
<6.1.3Update to 6.1.3
- Critical9.8SQL Injection
FeedWordPress
<2015.0514Update to 2015.0514
- High7.5Arbitrary File Download via Path Traversal
Simple Backup
<2.7.11Update to 2.7.11
- High8.8Cross-Site Request Forgery
Brute Force Login Protection
≤1.5.1No patch available
- High7.5Sensitive Information Disclosure
Blessing Premium Responsive WordPress Theme
<1.3.2.1Update to 1.3.2.1
- High7.5Sensitive Information Disclosure
Goodnex Responsive HTML5/CSS3 Site Template
<1.1.3Update to 1.1.3
- Medium6.1Cross-Site Scripting
Awesome Support – WordPress HelpDesk & Support Plugin
<3.1.7Update to 3.1.7
- High7.5Sensitive Information Disclosure
Almera Responsive Portfolio Site Template
<1.1.8Update to 1.1.8