CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1349)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High8.8 | Cross-Site Request Forgery | CVE-2014-2550 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-5329 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2012-20003 | — | |
| Medium5.3 | Information Disclosure | CVE-2013-4454 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2706 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-3870 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2014-1888 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4855 | — | |
| Medium5.3 | Cross-Site Scripting | CVE-2011-4562 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-3434 | — | |
| Critical9.8 | Unauthenticated Command Injection | CVE-2014-3114 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-3253 | — | |
| Medium6.3 | Cross-Site Request Forgery | CVE-2013-2708 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3487 | — | |
| Medium6.1 | Open Redirection | CVE-2013-2694 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2013-1636 | — | |
| High8.1 | Unauthenticated Local File Inclusion | CVE-2012-20002 | — | |
| Medium6.5 | Cross-Site Request Forgery | CVE-2014-2675 | — | |
| High7.3 | Authentication Bypass | CVE-2012-5469 | — | |
| Medium6.1 | Cross-Site Scripting via Search Parameter | CVE-2013-5988 | — | |
| High8.8 | SQL Injection | CVE-2012-5328 | — | |
| Medium6.1 | Reflected Cross Site Scripting | CVE-2011-5194 | — | |
| High8.8 | Remote Code Execution | CVE-2013-2009 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2013-2698 | — | |
| High7.2 | Cross-Site Scripting | CVE-2014-4664 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-9100 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-9099 | — | |
| Critical9.8 | SQL Injection | CVE-2014-5200 | — | |
| Critical9.8 | SQL Injection | CVE-2014-5189 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2014-9098 | — |
- High8.8Cross-Site Request Forgery
Disable Comments
<1.0.4Update to 1.0.4
- Medium6.1Reflected Cross-Site Scripting
Redirection
<2.2.9Update to 2.2.9
- Medium6.1Reflected Cross-Site Scripting
custom-tables
≤3.4.4No patch available
- Medium5.3Information Disclosure
Portable phpMyAdmin
≤1.4.1No patch available
- High8.8Cross-Site Request Forgery
Stream Video Player
≤1.4.1No patch available
- Medium6.1Cross-Site Scripting
bib2html
≤0.9.3No patch available
- Medium6.4Stored Cross-Site Scripting
BuddyPress
≤1.9.1Update to 1.9.2
- High7.1Cross-Site Scripting
Polylang
<1.5.2Update to 1.5.2
- Medium5.3Cross-Site Scripting
Redirection
<2.2.10Update to 2.2.10
- Medium6.1Cross-Site Scripting
Count per Day
≤3.1.1Update to 3.2
- Critical9.8Unauthenticated Command Injection
EZPZ One Click Backup
≤12.03.10No patch available
- High8.8Cross-Site Request Forgery
Xhanch – My Twitter
≤2.7.6Update to 2.7.7
- Medium6.3Cross-Site Request Forgery
WordPress Content Slide
≤1.4.2No patch available
- Medium6.1Cross-Site Scripting
BulletProof Security
≤.48.9Update to .49
- Medium6.1Open Redirection
WP Symposium
≤13.04Update to 13.05
- High7.2Stored Cross-Site Scripting
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
<1.6.3Update to 1.6.3
- High8.1Unauthenticated Local File Inclusion
Tinymce Thumbnail Gallery
≤1.0.0Update to 1.1.0
- Medium6.5Cross-Site Request Forgery
wp-html-sitemap
≤1.2No patch available
- High7.3Authentication Bypass
Portable phpMyAdmin
≤1.3.0Update to 1.3.1
- Medium6.1Cross-Site Scripting via Search Parameter
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
≤2.0.3Update to 2.0.3.1
- High8.8SQL Injection
Mingle Forum
<1.0.33Update to 1.0.33
- Medium6.1Reflected Cross Site Scripting
WHOIS
≤1.4.2.2Update to 1.4.2.3
- High8.8Remote Code Execution
WP Super Cache
≤1.2Update to 1.3
- Medium4.3Cross-Site Request Forgery
Calendar
≤1.3.2Update to 1.3.3
- High7.2Cross-Site Scripting
Wordfence Security – Firewall, Malware Scan, and Login Security
≤5.1.3Update to 5.1.4
- Medium6.1Reflected Cross-Site Scripting
WhyDoWork AdSense
≤1.2No patch available
- High8.8Cross-Site Request Forgery
WhyDoWork AdSense
≤1.2No patch available
- Critical9.8SQL Injection
fbgorilla
all versionsNo patch available
- Critical9.8SQL Injection
Lead-Octopus-Power
<1.1.1Update to 1.1.1
- Medium5.4Cross-Site Scripting
WORDPRESS VIDEO GALLERY
≤2.5Update to 2.6