CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1337)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2015-9520 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9373 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9515 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9294 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9527 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9523 | — | |
| Critical9.8 | SQL Injection | CVE-2015-3313 | — | |
| Medium6.1 | Cross-Site Scripting Easy Digital Downloads – eCommerce Payments and Subscriptions made easy≤2.3.6Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7 | CVE-2015-9512 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9376 | — | |
| Medium5.3 | Reflected Cross Site Scripting | CVE-2015-10098 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9370 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9524 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9529 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9375 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9363 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9519 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9362 | — | |
| Medium5.4 | Cross-Site Scripting via Ephox in Plupload | CVE-2015-3439 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9511 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9513 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9365 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9532 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9356 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-10110 | — | |
| Medium5.3 | Cross-Site Scripting | CVE-2014-4518 | — | |
| High7.5 | Missing Access Controls | CVE-2015-9337 | — | |
| Medium5.3 | SQL Injection | CVE-2015-3325 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9493 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-10137 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9333 | — |
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Per Product Emails
<1.0.9Update to 1.0.9
- Medium6.1Cross-Site Scripting
PayPal Pro Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads – htaccess Editor
1.0.0 – 1.0.0Update to 1.0.1
- Medium6.1Reflected Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
<3.9.5Update to 3.9.5
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Simple Shipping
≤2.1.3Update to 2.1.4
- Medium6.1Cross-Site Scripting
Recommended Products - EDD
≤1.2.3.2Update to 1.2.3.3
- Critical9.8SQL Injection
Community Events
≤1.3Update to 1.4
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.3.6Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7
- Medium6.1Reflected Cross-Site Scripting
Mobile
<1.2.8Update to 1.2.8
- Medium5.3Reflected Cross Site Scripting
Broken Link Checker
<1.10.6Update to 1.10.6
- Medium6.1Reflected Cross-Site Scripting
Exchange Addon Invoices
<1.4.0Update to 1.4.0
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Recount Earnings
<2.3.7Update to 2.3.7
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads (EDD) Stripe
≤2.1.2Update to 2.1.3
- Medium6.1Cross-Site Scripting
exchange-addon-table-rate-shipping
<1.1.0Update to 1.1.0
- Medium6.1Cross-Site Scripting
ithemes-exchange
<1.12.0Update to 1.12.0
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – PDF stamper
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Post Connector
<1.0.4Update to 1.0.4
- Medium5.4Cross-Site Scripting via Ephox in Plupload
WordPress
≤4.1.1Update to 3.7.6 or 3.8.6 or 3.9.4 or 4.0.2 or 4.1.2
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Conditional Success Redirects
<1.1.1Update to 1.1.1
- Medium6.1Cross-Site Scripting
EDD Favorites
≤1.0.6Update to 1.0.7
- Medium6.1Reflected Cross-Site Scripting
Authorize.net Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
- Medium6.1Cross-Site Scripting
Easy Digital Downloads (EDD) Digital Store
<1.3.3Update to 1.3.3
- Medium6.1Cross-Site Scripting
WP-ViperGB
<1.3.16Update to 1.3.16
- Medium6.1Reflected Cross-Site Scripting
TinyChat Room Spy
≤1.2.8Update to 1.2.9
- Medium5.3Cross-Site Scripting
Contact Form by ContactMe.com
≤2.3No patch available
- High7.5Missing Access Controls
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤2.1.3Update to 2.1.4
- Medium5.3SQL Injection
WP Symposium
<15.4Update to 15.4
- Medium6.1Cross-Site Scripting
My Wish List
<1.4.2Update to 1.4.2
- Critical9.8Arbitrary File Upload
Website Contact Form With File Upload
≤1.3.4Update to 1.4
- Critical9.8SQL Injection
cformsII
<14.6.10Update to 14.6.10