CWE-862Vulnerability type

WordPress Missing Authorization vulnerabilities (page 1348)

AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Missing Authorization vulnerabilities (page 1348)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Cross-Site Scripting Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider≤2.5Update to 2.6	CVE-2014-4846	—	Aug 1, 2014
High8.8	Remote Code Execution WP Super Cache≤1.2Update to 1.3	CVE-2013-2009	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting wp-media-player≤0.8No patch available	CVE-2014-4589	—	Aug 1, 2014
Critical9.8	SQL Injection Yoast Duplicate Post≤2.5Update to 2.6	CVE-2014-10379	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Events Manager Pro<2.2.9Update to 2.2.9	CVE-2013-1407	—	Aug 1, 2014
Critical9.9	Authenticated SQL Injection BSK PDF Manager<1.5Update to 1.5	CVE-2014-4944	—	Aug 1, 2014
Critical9.8	Arbitrary File Upload WordPress Font Uploader≤1.3Update to 1.3.1	CVE-2012-3814	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Adminimize≤1.7.21Update to 1.7.22	CVE-2011-4926	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery Xhanch – My Twitter≤2.7.6Update to 2.7.7	CVE-2013-3253	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery Disable Comments<1.0.4Update to 1.0.4	CVE-2014-2550	—	Aug 1, 2014
Medium5.3	Information Disclosure Portable phpMyAdmin≤1.4.1No patch available	CVE-2013-4454	—	Aug 1, 2014
Medium6.1	Cross-Site scripting Hot Files: File Sharing and Download Manager Plugin≤1.0.0No patch available	CVE-2014-4588	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting bib2html≤0.9.3No patch available	CVE-2014-3870	—	Aug 1, 2014
High8.1	Unauthenticated Local File Inclusion Tinymce Thumbnail Gallery≤1.0.0Update to 1.1.0	CVE-2012-20002	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery Stream Video Player≤1.4.1No patch available	CVE-2013-2706	—	Aug 1, 2014
High7.1	Cross-Site Scripting Polylang<1.5.2Update to 1.5.2	CVE-2014-4855	—	Aug 1, 2014
Medium5.3	Cross-Site Scripting Redirection<2.2.10Update to 2.2.10	CVE-2011-4562	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting via Search Parameter All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)≤2.0.3Update to 2.0.3.1	CVE-2013-5988	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting WP App Maker≤1.0.16.4No patch available	CVE-2014-4578	—	Aug 1, 2014
Critical9.8	Unauthenticated Command Injection EZPZ One Click Backup≤12.03.10No patch available	CVE-2014-3114	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting Redirection<2.2.9Update to 2.2.9	CVE-2011-5329	—	Aug 1, 2014
Medium6.4	Stored Cross-Site Scripting BuddyPress≤1.9.1Update to 1.9.2	CVE-2014-1888	—	Aug 1, 2014
Medium6.5	Cross-Site Request Forgery wp-html-sitemap≤1.2No patch available	CVE-2014-2675	—	Aug 1, 2014
Medium6.1	Open Redirection WP Symposium≤13.04Update to 13.05	CVE-2013-2694	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Count per Day≤3.1.1Update to 3.2	CVE-2012-3434	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting custom-tables≤3.4.4No patch available	CVE-2012-20003	—	Aug 1, 2014
Medium6.3	Cross-Site Request Forgery WordPress Content Slide≤1.4.2No patch available	CVE-2013-2708	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting BulletProof Security≤.48.9Update to .49	CVE-2013-3487	—	Aug 1, 2014
High8.8	SQL Injection Mingle Forum<1.0.33Update to 1.0.33	CVE-2012-5328	—	Aug 1, 2014
Medium5.3	Full Path Disclosure WP PHP widget≤1.0.2No patch available	CVE-2013-0721	—	Aug 1, 2014

Medium6.1
Cross-Site Scripting
Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider
≤2.5Update to 2.6
CVE-2014-4846Aug 1, 2014
High8.8
Remote Code Execution
WP Super Cache
≤1.2Update to 1.3
CVE-2013-2009Aug 1, 2014
Medium6.1
Cross-Site Scripting
wp-media-player
≤0.8No patch available
CVE-2014-4589Aug 1, 2014
Critical9.8
SQL Injection
Yoast Duplicate Post
≤2.5Update to 2.6
CVE-2014-10379Aug 1, 2014
Medium6.1
Cross-Site Scripting
Events Manager Pro
<2.2.9Update to 2.2.9
CVE-2013-1407Aug 1, 2014
Critical9.9
Authenticated SQL Injection
BSK PDF Manager
<1.5Update to 1.5
CVE-2014-4944Aug 1, 2014
Critical9.8
Arbitrary File Upload
WordPress Font Uploader
≤1.3Update to 1.3.1
CVE-2012-3814Aug 1, 2014
Medium6.1
Cross-Site Scripting
Adminimize
≤1.7.21Update to 1.7.22
CVE-2011-4926Aug 1, 2014
High8.8
Cross-Site Request Forgery
Xhanch – My Twitter
≤2.7.6Update to 2.7.7
CVE-2013-3253Aug 1, 2014
High8.8
Cross-Site Request Forgery
Disable Comments
<1.0.4Update to 1.0.4
CVE-2014-2550Aug 1, 2014
Medium5.3
Information Disclosure
Portable phpMyAdmin
≤1.4.1No patch available
CVE-2013-4454Aug 1, 2014
Medium6.1
Cross-Site scripting
Hot Files: File Sharing and Download Manager Plugin
≤1.0.0No patch available
CVE-2014-4588Aug 1, 2014
Medium6.1
Cross-Site Scripting
bib2html
≤0.9.3No patch available
CVE-2014-3870Aug 1, 2014
High8.1
Unauthenticated Local File Inclusion
Tinymce Thumbnail Gallery
≤1.0.0Update to 1.1.0
CVE-2012-20002Aug 1, 2014
High8.8
Cross-Site Request Forgery
Stream Video Player
≤1.4.1No patch available
CVE-2013-2706Aug 1, 2014
High7.1
Cross-Site Scripting
Polylang
<1.5.2Update to 1.5.2
CVE-2014-4855Aug 1, 2014
Medium5.3
Cross-Site Scripting
Redirection
<2.2.10Update to 2.2.10
CVE-2011-4562Aug 1, 2014
Medium6.1
Cross-Site Scripting via Search Parameter
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
≤2.0.3Update to 2.0.3.1
CVE-2013-5988Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
WP App Maker
≤1.0.16.4No patch available
CVE-2014-4578Aug 1, 2014
Critical9.8
Unauthenticated Command Injection
EZPZ One Click Backup
≤12.03.10No patch available
CVE-2014-3114Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
Redirection
<2.2.9Update to 2.2.9
CVE-2011-5329Aug 1, 2014
Medium6.4
Stored Cross-Site Scripting
BuddyPress
≤1.9.1Update to 1.9.2
CVE-2014-1888Aug 1, 2014
Medium6.5
Cross-Site Request Forgery
wp-html-sitemap
≤1.2No patch available
CVE-2014-2675Aug 1, 2014
Medium6.1
Open Redirection
WP Symposium
≤13.04Update to 13.05
CVE-2013-2694Aug 1, 2014
Medium6.1
Cross-Site Scripting
Count per Day
≤3.1.1Update to 3.2
CVE-2012-3434Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
custom-tables
≤3.4.4No patch available
CVE-2012-20003Aug 1, 2014
Medium6.3
Cross-Site Request Forgery
WordPress Content Slide
≤1.4.2No patch available
CVE-2013-2708Aug 1, 2014
Medium6.1
Cross-Site Scripting
BulletProof Security
≤.48.9Update to .49
CVE-2013-3487Aug 1, 2014
High8.8
SQL Injection
Mingle Forum
<1.0.33Update to 1.0.33
CVE-2012-5328Aug 1, 2014
Medium5.3
Full Path Disclosure
WP PHP widget
≤1.0.2No patch available
CVE-2013-0721Aug 1, 2014