CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1366)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.3 | Incorrect Authorization Checks | CVE-2011-5270 | — | |
| Medium4.3 | Incorrect Authorization for Contributor-level users | CVE-2011-1762 | — | |
| High7.5 | Denial of Service | CVE-2011-4957 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2011-4956 | — | |
| High7.5 | Path Traversal | CVE-2011-1669 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2011-4342 | — | |
| High7.1 | Cross-Site Request Forgery | CVE-2011-0760 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2011-5304 | — | |
| High8.8 | Multiple Cross-Site Request Forgery | CVE-2011-0759 | — | |
| High7.5 | Directory Traversal | CVE-2011-5208 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5307 | — | |
| Critical9.8 | SQL Injection | CVE-2011-1047 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2011-10041 | — | |
| High8.8 | Arbitrary File Upload | CVE-2013-1916 | — | |
| Critical9.8 | SQL Injection | CVE-2011-5308 | — | |
| Medium4.3 | Improper Authorization to Information Disclosure | CVE-2011-0701 | — | |
| High7.5 | Sensitive Information Disclosure | CVE-2011-3818 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-0740 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-0641 | — | |
| Medium5.4 | Missing Authorization | CVE-2010-5296 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2010-4536 | — | |
| High7.1 | Cross-Site Scripting | CVE-2010-4277 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2010-4747 | — | |
| Medium6.3 | Access Control Bypass | CVE-2010-5106 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2010-4518 | — | |
| High7.1 | Reflected Cross-Site Scripting | CVE-2010-4825 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2010-4779 | — | |
| Medium5.3 | Spam Protection Bypass | CVE-2010-5293 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2010-5294 | — | |
| High8.8 | SQL Injection | CVE-2010-4257 | — |
- Medium6.3Incorrect Authorization Checks
WordPress
<3.0.6Update to 3.0.6
- Medium4.3Incorrect Authorization for Contributor-level users
WordPress
≤3.1.1Update to 3.1.2
- High7.5Denial of Service
WordPress
<3.1.1Update to 3.1.1
- Medium6.4Cross-Site Scripting
WordPress
≤3.1Update to 3.1.1
- High7.5Path Traversal
WP Custom Pages
≤0.5.0.1No patch available
- Critical9.8Remote File Inclusion
BackWPup – WordPress Backup & Restore Plugin
≤1.7.1Update to 1.7.2
- High7.1Cross-Site Request Forgery
WP Related Posts
<1.1Update to 1.1
- Medium6.1Multiple Cross-Site Scripting
SodaHead Polls
<2.0.4Update to 2.0.4
- High8.8Multiple Cross-Site Request Forgery
WP-reCAPTCHA
≤2.9.8.2Update to 3.0
- High7.5Directory Traversal
BackWPup – WordPress Backup & Restore Plugin
<1.4.1Update to 1.4.1
- Medium6.1Cross-Site Scripting
photosmash-galleries
<1.0.5Update to 1.0.5
- Critical9.8SQL Injection
WP Forum Server
≤1.6.5Update to 1.6.6
- Critical9.8Arbitrary File Upload
Uploadify
≤1.0No patch available
- High8.8Arbitrary File Upload
User Photo
≤0.9.4Update to 0.9.5
- Critical9.8SQL Injection
CDN Vote
<0.4.2Update to 0.4.2
- Medium4.3Improper Authorization to Information Disclosure
WordPress
≤3.0.4Update to 3.0.5
- High7.5Sensitive Information Disclosure
WordPress
≤3.0.4Update to 3.0 or 3.0.5
- Medium6.1Cross-Site Scripting
RSS Feed Reader
≤0.1No patch available
- Medium6.1Cross-Site Scripting
StatPressCN
≤1.9.0Update to 1.9.1
- Medium5.4Missing Authorization
WordPress
<3.0.2Update to 3.0.2
- Medium6.4Cross-Site Scripting
WordPress
≤3.0.3Update to 3.0.4
- High7.1Cross-Site Scripting
Embedded Video
≤4.1No patch available
- Medium6.1Cross-Site Scripting
WordPress Processing Embed
≤0.5.1No patch available
- Medium6.3Access Control Bypass
WordPress
≤3.0.2Update to 3.0.3
- Medium6.1Cross-Site Scripting
WP Safe Search
≤0.7No patch available
- High7.1Reflected Cross-Site Scripting
Peadig's Twitter Feed: Embedded Timeline WordPress Plugin
≤2.2No patch available
- Medium6.1Cross-Site Scripting
WPtouch – Make your WordPress Website Mobile-Friendly
<1.9.20Update to 1.9.20
- Medium5.3Spam Protection Bypass
WordPress
<3.0.2Update to 3.0.2
- Medium6.4Cross-Site Scripting
WordPress
<3.0.2Update to 3.0.2
- High8.8SQL Injection
WordPress
≤3.0.1Update to 3.0.2