CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1351)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4570 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4598 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4586 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4548 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4573 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4575 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4591 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4585 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2014-4595 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-4163 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-3850 | — | |
| Medium4.3 | Cross-Site Request Forgery leading to player deletion | CVE-2014-4030 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-5345 | — | |
| Critical9.8 | SQL Injection | CVE-2014-3961 | — | |
| High7.2 | Cross-Site Scripting | CVE-2014-3921 | — | |
| High7.5 | Path Traversal | CVE-2014-4941 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4546 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4564 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2014-4942 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4513 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4541 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4540 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4557 | — | |
| Medium6.1 | Unauthenticated Cross-Site Scripting | CVE-2014-4523 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4519 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4593 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4538 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4516 | — | |
| Critical9.8 | SQL Injection | CVE-2014-4938 | — | |
| High8.8 | SQL Injection | CVE-2014-5185 | — |
- Medium6.1Reflected Cross-Site Scripting
VideoWhisper Video Presentation
≤3.25Update to 3.31
- High7.1Cross-Site Scripting
wp-tmkm-amazon
<1.5.3Update to 1.5.3
- Medium6.1Cross-Site Scripting
wp-football
≤1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Ruven Toolkit
≤2.0No patch available
- High7.1Cross-Site Scripting
Walk Score Plugin
≤0.5.5No patch available
- Medium6.1Cross-Site Scripting
WikiPop
≤2.0No patch available
- Medium6.1Reflected Cross-Site Scripting
WP-Picasa-Image
≤1.0No patch available
- Medium6.1Cross-Site Scripting
WP-FaceThumb
≤1.0No patch available
- Medium6.1Multiple Cross-Site Scripting
wp-restful
≤0.1No patch available
- High8.8Cross-Site Request Forgery
Featured Comments
<1.2.5Update to 1.2.5
- Medium6.1Cross-Site Scripting
Member Approval
≤131109No patch available
- Medium4.3Cross-Site Request Forgery leading to player deletion
JW Player for Flash & HTML5 Video
<2.1.4Update to 2.1.4
- Medium6.1Reflected Cross-Site Scripting
Disqus Comment System
<2.76Update to 2.76
- Critical9.8SQL Injection
Participants Database
<1.5.4.9Update to 1.5.4.9
- High7.2Cross-Site Scripting
simple-popup-images
≤1.0Update to 1.1
- High7.5Path Traversal
Cross-RSS
≤1.7No patch available
- Medium6.1Cross-Site Scripting
Rezgo Online Booking
<1.4.3Update to 1.4.3
- Medium6.1Cross-Site Scripting
Validated
≤1.0.2Update to 2.0.0
- Medium5.3Sensitive Information Disclosure
WP EasyCart: Shopping Cart and eCommerce Store
≤2.0.5Update to 2.0.6
- Medium6.1Reflected Cross-Site Scripting
ActiveHelper LiveHelp Live Chat
<3.1.5Update to 3.1.5
- Medium6.1Cross-Site Scripting
OMFG Mobile Pro
≤1.1.26No patch available
- High7.1Cross-Site Scripting
Oleggo LiveStream
≤0.2.6No patch available
- Medium6.1Cross-Site Scripting
Jigoshop Swipe plugin
≤3.1.0No patch available
- Medium6.1Unauthenticated Cross-Site Scripting
Easy Career Openings
≤0.4No patch available
- Medium6.1Reflected Cross-Site Scripting
Conversador
≤2.61No patch available
- Medium6.1Cross-Site Scripting
wppm
≤1.6.4.bNo patch available
- High7.1Cross-Site Scripting
Malware Finder
≤1.1No patch available
- Medium6.1Cross-Site Scripting
BIC Media Widget
≤1.0No patch available
- Critical9.8SQL Injection
WP Rss Poster
≤1.0.0No patch available
- High8.8SQL Injection
quartz
≤1.01.1No patch available