CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1350)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.4 | Cross-Site Scripting | CVE-2014-9098 | — | |
| Critical9.8 | SQL Injection | CVE-2014-9097 | — | |
| Medium6.1 | JavaScript Code Injection | CVE-2014-10386 | — | |
| Critical9.8 | Arbitrary Command Execution | CVE-2014-5014 | — | |
| High7.5 | Sensitive Information Disclosure | CVE-2014-9012 | — | |
| Medium6.1 | Cross-Site Scripting User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor<1.1.66Update to 1.1.66 | CVE-2014-10380 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-5202 | — | |
| Medium6.1 | Cross-Site Scrpting | CVE-2014-8622 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-125132 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4596 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4603 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2014-4587 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4571 | — | |
| High7.2 | Cross-Site Scripting | CVE-2014-4515 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4569 | — | |
| High8.8 | Local File Inclusion | CVE-2014-5155 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4724 | — | |
| High8.8 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2014-4848 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4847 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4723 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-4717 | — | |
| Critical9.8 | Remote Code Execution | CVE-2014-4663 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4590 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4580 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4601 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4582 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4567 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4579 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4575 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4568 | — |
- Medium5.4Cross-Site Scripting
WORDPRESS VIDEO GALLERY
≤2.5Update to 2.6
- Critical9.8SQL Injection
WORDPRESS VIDEO GALLERY
<2.6Update to 2.6
- Medium6.1JavaScript Code Injection
3CX Free Live Chat, Calls & Messaging
<4.1.0Update to 4.1.0
- Critical9.8Arbitrary Command Execution
WordPress Flash Uploader
<3.1.3Update to 3.1.3
- High7.5Sensitive Information Disclosure
WP BackItUp Community Edition
≤1.9Update to 1.9.1
- Medium6.1Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<1.1.66Update to 1.1.66
- Medium6.1Reflected Cross-Site Scripting
Compfight
≤1.4Update to 1.5
- Medium6.1Cross-Site Scrpting
Compfight
<1.5Update to 1.5
- Medium6.1Reflected Cross-Site Scripting
Blogroll Fun – Show Last Post and Last Update Time
<0.8.5Update to 0.8.5
- Medium6.1Cross-Site Scripting
WP Snap App
≤1.5No patch available
- High7.1Cross-Site Scripting
yahoo-updates-for-wordpress
≤1.0No patch available
- Medium6.1Multiple Cross-Site Scripting
wp-guestmap
≤1.8No patch available
- Medium6.1Cross-Site Scripting
vn-calendar
≤1.0No patch available
- High7.2Cross-Site Scripting
anyfont
≤2.2.3No patch available
- Medium6.1Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
<4.27.4Update to 4.27.4
- High8.8Local File Inclusion
Theme My Login
<6.3.10Update to 6.3.10
- High7.1Cross-Site Scripting
Custom Banners
<2.1Update to 2.1
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Blogstand Banner
≤1.0No patch available
- High7.1Cross-Site Scripting
Random Banner
<2.0Update to 2.0
- High7.1Cross-Site Scripting
Easy Banners
≤1.4No patch available
- High8.8Cross-Site Request Forgery
Simple Share Buttons Adder
≤4.4Update to 4.5
- Critical9.8Remote Code Execution
Ajax Search Lite – Live Search & Filter
<3.11Update to 3.11
- High7.1Cross-Site Scripting
WP Microblogs
≤0.4.0No patch available
- Medium6.1Cross-Site Scripting
WP BlipBot
≤3.0.9No patch available
- Medium6.1Cross-Site Scripting
Wu-Rating
≤1.0 12319No patch available
- Medium6.1Reflected Cross-Site Scripting
WP Consultant
≤1.0No patch available
- Medium6.1Cross-Site Scripting
Webcam/Screen/Mic Recorder for Video Comments and Forms
≤1.55Update to 1.55.3
- Medium6.1Cross-Site Scripting
Appointments Scheduler
≤1.5No patch available
- Medium6.1Cross-Site Scripting
WikiPop
≤2.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Webcam Microphone Screen Recorder – Media Capture
≤1.55.4Update to 1.55.5