CWE-862Vulnerability type

WordPress Missing Authorization vulnerabilities (page 1336)

AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Missing Authorization vulnerabilities (page 1336)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Reflected Cross-Site Scripting Related Posts≤1.8.1Update to 1.8.2	CVE-2015-9361	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads – Attach Accounts to Orders≤2.0.1Update to 2.0.2	CVE-2015-9507	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – Software Licensing<3.2.3Update to 3.2.3	CVE-2015-9528	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads – Pushover notifications≤1.2.8Update to 1.2.9	CVE-2015-9521	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – Invoices<1.0.4Update to 1.0.4	CVE-2015-9518	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting iThemes Builder Style Manager<0.7.7Update to 0.7.7	CVE-2015-9379	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Stripe Add-on for iThemes Exchange<1.2.0Update to 1.2.0	CVE-2015-9374	—	Apr 20, 2015
Medium6.1	Quota < 1.2.5 - Cross-Site Scripting Easy Digital Downloads - Quota<1.2.5Update to 1.2.5	CVE-2015-9534	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads - Recurring Payments≤2.3Update to 2.3.1	CVE-2015-9525	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting 2Checkout Add-on for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9364	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads - QR Codes≤1.1.0Update to 1.1.1	CVE-2015-9522	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Shoppette<1.0.5Update to 1.0.5	CVE-2015-9535	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads - Free Downloads≤2.3.6Update to 2.3.7	CVE-2015-9514	—	Apr 20, 2015
Medium6.1	Cross-Sell and Upsell <= 1.1.2 - Reflected Cross-Site Scripting Easy Digital Downloads - Cross-Sell and Upsell≤1.1.2Update to 1.1.3	CVE-2015-9510	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads – Manual Purchases<1.9.1Update to 1.9.1	CVE-2015-9517	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads - Wish Lists≤1.1Update to 1.1.1	CVE-2015-9531	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy US Sales Taxes Add-on for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9369	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Exchange Addon Custom URL Tracking<1.1.0Update to 1.1.0	CVE-2015-9366	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Market<5.1.27Update to 5.1.27	CVE-2015-9378	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Manual Purchases Add-on for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9371	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – eCommerce Payments and Subscriptions made easy<2.3.7Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7	CVE-2015-9505	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads - Product Reviews≤1.3.8Update to 1.3.10	CVE-2015-9526	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Exchange Addon Membership<1.3.0Update to 1.3.0	CVE-2015-9372	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads - Amazon S3≤2.1.3Update to 2.1.4	CVE-2015-9506	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – Invoices≤1.0.3Update to 1.0.4	CVE-2015-9516	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Two Factor Authentication<1.1.10Update to 1.1.10	CVE-2015-9355	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads – htaccess Editor1.0.0 – 1.0.0Update to 1.0.1	CVE-2015-9515	—	Apr 20, 2015
Critical9.8	SQL Injection Tune Library<1.5.5Update to 1.5.5	CVE-2015-3314	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting PayPal Pro Add-on for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9373	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Recommended Products - EDD≤1.2.3.2Update to 1.2.3.3	CVE-2015-9523	—	Apr 20, 2015

Medium6.1
Reflected Cross-Site Scripting
Related Posts
≤1.8.1Update to 1.8.2
CVE-2015-9361Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads – Attach Accounts to Orders
≤2.0.1Update to 2.0.2
CVE-2015-9507Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – Software Licensing
<3.2.3Update to 3.2.3
CVE-2015-9528Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads – Pushover notifications
≤1.2.8Update to 1.2.9
CVE-2015-9521Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – Invoices
<1.0.4Update to 1.0.4
CVE-2015-9518Apr 20, 2015
Medium6.1
Cross-Site Scripting
iThemes Builder Style Manager
<0.7.7Update to 0.7.7
CVE-2015-9379Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Stripe Add-on for iThemes Exchange
<1.2.0Update to 1.2.0
CVE-2015-9374Apr 20, 2015
Medium6.1
Quota < 1.2.5 - Cross-Site Scripting
Easy Digital Downloads - Quota
<1.2.5Update to 1.2.5
CVE-2015-9534Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads - Recurring Payments
≤2.3Update to 2.3.1
CVE-2015-9525Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
2Checkout Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9364Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads - QR Codes
≤1.1.0Update to 1.1.1
CVE-2015-9522Apr 20, 2015
Medium6.1
Cross-Site Scripting
Shoppette
<1.0.5Update to 1.0.5
CVE-2015-9535Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads - Free Downloads
≤2.3.6Update to 2.3.7
CVE-2015-9514Apr 20, 2015
Medium6.1
Cross-Sell and Upsell <= 1.1.2 - Reflected Cross-Site Scripting
Easy Digital Downloads - Cross-Sell and Upsell
≤1.1.2Update to 1.1.3
CVE-2015-9510Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads – Manual Purchases
<1.9.1Update to 1.9.1
CVE-2015-9517Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads - Wish Lists
≤1.1Update to 1.1.1
CVE-2015-9531Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy US Sales Taxes Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9369Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Exchange Addon Custom URL Tracking
<1.1.0Update to 1.1.0
CVE-2015-9366Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Market
<5.1.27Update to 5.1.27
CVE-2015-9378Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Manual Purchases Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9371Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
<2.3.7Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7
CVE-2015-9505Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads - Product Reviews
≤1.3.8Update to 1.3.10
CVE-2015-9526Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Exchange Addon Membership
<1.3.0Update to 1.3.0
CVE-2015-9372Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads - Amazon S3
≤2.1.3Update to 2.1.4
CVE-2015-9506Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – Invoices
≤1.0.3Update to 1.0.4
CVE-2015-9516Apr 20, 2015
Medium6.1
Cross-Site Scripting
Two Factor Authentication
<1.1.10Update to 1.1.10
CVE-2015-9355Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads – htaccess Editor
1.0.0 – 1.0.0Update to 1.0.1
CVE-2015-9515Apr 20, 2015
Critical9.8
SQL Injection
Tune Library
<1.5.5Update to 1.5.5
CVE-2015-3314Apr 20, 2015
Medium6.1
Cross-Site Scripting
PayPal Pro Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9373Apr 20, 2015
Medium6.1
Cross-Site Scripting
Recommended Products - EDD
≤1.2.3.2Update to 1.2.3.3
CVE-2015-9523Apr 20, 2015