CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1364)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2011-5192 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2012-5350 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2012-0287 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-5346 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5207 | — | |
| Medium6.1 | Authorization Bypass | CVE-2011-5254 | — | |
| High8.8 | Arbitrary File Upload | CVE-2011-5051 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2011-5226 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5225 | — | |
| Critical9.8 | SQL Injection | CVE-2011-5224 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5191 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-5264 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-4595 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-5180 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-4624 | — | |
| High7.1 | Cross-Site Scripting | CVE-2011-5179 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5265 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5181 | — | |
| Medium5.3 | Stored Cross-Site Scripting | CVE-2011-5104 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5107 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5106 | — | |
| Critical9.8 | SQL Injection | CVE-2011-4671 | — | |
| High7.3 | SQL Injection | CVE-2011-4803 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3860 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2011-5328 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2011-5257 | — | |
| Critical9.8 | SQL Injection | CVE-2011-4669 | — | |
| High8.8 | SQL Injection | CVE-2011-4646 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3862 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3850 | — |
- Medium6.1Cross-Site Scripting
Pretty Link Lite
<1.5.6Update to 1.5.6
- High8.8Authenticated SQL Injection
Pay With Tweet
≤1.1Update to 1.2
- Medium6.4Cross-Site Scripting
WordPress
≤3.3Update to 3.3.1
- Medium6.1Cross-Site Scripting
WP Live.php
≤1.2.1Update to 1.3
- Medium6.1Cross-Site Scripting
TheCartPress eCommerce Shopping Cart
≤1.1.5Update to 1.1.6
- Medium6.1Authorization Bypass
Connections Business Directory
≤0.7.1.5Update to 0.7.1.6
- High8.8Arbitrary File Upload
WP Symposium
<11.12.24Update to 11.12.24
- High8.8Cross-Site Request Forgery
WordPress Sentinel
≤1.0.0Update to 1.0.1
- Medium6.1Cross-Site Scripting
WordPress Sentinel
≤1.0.0Update to 1.0.1
- Critical9.8SQL Injection
WordPress Sentinel
≤1.0.0Update to 1.0.1
- Medium6.1Cross-Site Scripting
Pretty Link Lite
<1.5.4Update to 1.5.4
- Medium6.1Reflected Cross-Site Scripting
Lazyest Backup
<0.2.2Update to 0.2.2
- Medium6.1Reflected Cross-Site Scripting
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
<1.5.6Update to 1.5.6
- Medium6.1Reflected Cross-Site Scripting
ZooEffect Plugin for Video player, Photo Gallery Slideshow jQuery and audio / music / podcast – HTML5
≤1.11No patch available
- Medium6.1Cross-Site Scripting
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
<1.57Update to 1.57
- High7.1Cross-Site Scripting
Skysa App Bar Integration
≤1.03Update to 1.04
- Medium6.1Cross-Site Scripting
Featurific For WordPress
≤1.6.2No patch available
- Medium6.1Cross-Site Scripting
Live Chat from ClickDesk – Live Chat – Help Desk Plugin for Websites
≤2.0Update to 3.0
- Medium5.3Stored Cross-Site Scripting
WP eCommerce
<3.8.7.2Update to 3.8.7.2
- Medium6.1Cross-Site Scripting
Alert Before Your Post
≤0.1.1No patch available
- Medium6.1Cross-Site Scripting
Flexible Custom Post Type
<0.1.7Update to 0.1.7
- Critical9.8SQL Injection
AdRotate Banner Manager
<3.6.8Update to 3.6.8
- High7.3SQL Injection
WPtouch – Make your WordPress Website Mobile-Friendly
<1.9.8.1Update to 1.9.8.1
- Medium6.1Cross-Site Scripting
Cover WP
≤1.6.5Update to 1.6.6
- High8.8Cross-Site Request Forgery
User Access Manager
<1.2Update to 1.2
- Medium6.4Stored Cross-Site Scripting
Classipress
≤3.1.4Update to 3.1.5
- Critical9.8SQL Injection
WordPress Users
≤1.3Update to 1.4
- High8.8SQL Injection
WP-PostRatings
≤1.61Update to 1.62
- Medium6.1Cross-Site Scripting
Morning Coffee
<3.6Update to 3.6
- Medium6.1Cross-Site Scripting
Atahualpa
<3.6.8Update to 3.6.8