CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1368)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Sensitive Information Disclosure | CVE-2009-2334 | — | |
| Medium5.3 | Username Enumeration | CVE-2009-2335 | — | |
| Critical9.8 | SQL Injection | CVE-2009-2383 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2009-2396 | — | |
| Critical10.0 | SQL Injection | CVE-2009-2144 | — | |
| Critical9.8 | SQL Injection | CVE-2009-2122 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2009-2143 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2009-2431 | — | |
| Critical9.8 | Local File Inclusion | CVE-2009-4672 | — | |
| Critical9.8 | Remote Code Execution | CVE-2009-2852 | — | |
| Critical9.8 | SQL Injection | CVE-2009-0968 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2009-1030 | — | |
| High7.2 | Cross-Site Scripting | CVE-2008-5278 | — | |
| Medium5.3 | Denial of Service | CVE-2008-6767 | — | |
| High7.5 | Directory Traversal | CVE-2008-5752 | — | |
| Medium6.1 | Open Redirect | CVE-2008-6762 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2008-6811 | — | |
| Critical9.8 | SQL Injection | CVE-2008-4625 | — | |
| Critical9.8 | SQL Injection | CVE-2008-4732 | — | |
| High7.2 | SQL Injection | CVE-2008-4733 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2008-4734 | — | |
| Medium6.5 | Cryptographic Weakness | CVE-2008-4107 | — | |
| High8.1 | Arbitrary User Password Reset | CVE-2008-4106 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2008-4671 | — | |
| Medium5.9 | Cryptographic Weakness | CVE-2008-3747 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2008-3362 | — | |
| High7.2 | Cross-Site Scripting | CVE-2008-3233 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2008-7321 | — | |
| Medium4.4 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2008-7175 | — | |
| Critical9.8 | Unauthenticated SQL Injection | CVE-2008-2034 | — |
- Medium6.1Sensitive Information Disclosure
WordPress
≤2.8Update to 2.8.1
- Medium5.3Username Enumeration
WordPress
≤2.8Update to 2.8.1
- Critical9.8SQL Injection
Related Sites
≤2.2Update to 2.2.1
- Critical9.8Remote File Inclusion
dm-albums
≤1.9.2Update to 1.9.3
- Critical10.0SQL Injection
firestats
<1.6.2Update to 1.6.2
- Critical9.8SQL Injection
Photoracer Plugin
≤1.0No patch available
- Critical9.8Remote File Inclusion
firestats
<1.6.2Update to 1.6.2
- Medium5.3Sensitive Information Disclosure
WordPress
≤2.7.1Update to 2.8
- Critical9.8Local File Inclusion
wp-lytebox
≤1.3No patch available
- Critical9.8Remote Code Execution
WP-Syntax
≤0.9.9Update to 0.9.10
- Critical9.8SQL Injection
fmoblog
≤2.1No patch available
- Medium6.4Cross-Site Scripting
WordPress MU
<2.7Update to 2.7
- High7.2Cross-Site Scripting
WordPress
≤2.6.4Update to 2.6.5
- Medium5.3Denial of Service
WordPress
≤2.6.1Update to 2.7
- High7.5Directory Traversal
page-flip-image-gallery
≤0.2.2No patch available
- Medium6.1Open Redirect
WordPress
<2.8.1Update to 2.8.1
- Critical9.8Arbitrary File Upload
WP e-Commerce
≤3.4Update to 3.6.8 RC1
- Critical9.8SQL Injection
ShiftThis
≤2.3.1No patch available
- Critical9.8SQL Injection
WP Comment Remix
<1.4.4Update to 1.4.4
- High7.2SQL Injection
WP Comment Remix
≤1.4.3Update to 1.4.4
- High8.8Cross-Site Request Forgery
WP Comment Remix
<1.4.4Update to 1.4.4
- Medium6.5Cryptographic Weakness
WordPress
≤2.6.1Update to 2.6.2
- High8.1Arbitrary User Password Reset
WordPress
≤2.6.1Update to 2.6.2
- Medium6.4Cross-Site Scripting
WordPress MU
<2.6Update to 2.6
- Medium5.9Cryptographic Weakness
WordPress
≤2.6Update to 2.6.1
- Critical9.8Arbitrary File Upload
Downloads Manager
≤0.2No patch available
- High7.2Cross-Site Scripting
WordPress
<2.6Update to 2.6
- Medium6.1Cross-Site Scripting
TubePress
≤1.5.7Update to 1.6.5
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤1.9.0Update to 1.9.1
- Critical9.8Unauthenticated SQL Injection
Download Monitor
≤2.0.6Update to 2.0.9