CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 31)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
≤3.2.7Update to 3.2.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization
LiteSpeed Cache
≤7.9.1Update to 7.9.2
- Medium5.4Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)
LiteSpeed Cache
≤7.9.1Update to 7.9.2
- Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText
Greenshift – animation and page builder blocks
≤13.2.1Update to 13.2.2
- Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block
Greenshift – animation and page builder blocks
≤13.2.1Update to 13.2.2
- Medium4.7Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
≤5.2.12Update to 5.2.13
- Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property
Extensions for Leaflet Map
≤5.4Update to 6.0
- Medium6.1Reflected Cross-Site Scripting via 'evf_toast_type' Parameter
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.6.2Update to 3.6.3
- Medium5.3Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.6.2Update to 3.6.3
- Medium6.5Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute
JoomSport – for Sports: Team & League, Football, Hockey & more
≤5.7.11Update to 5.7.14
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys
Sequential Order Numbers for WooCommerce
≤3.6.5Update to 3.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler
Password Protected
≤2.8.4Update to 2.8.5
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter
Schema App Structured Data
≤2.3.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption
DSGVO All in one for WP
≤5.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie
Food Store – Online Food Delivery & Pickup
≤1.5.5No patch available
- High7.5Unauthenticated SQL Injection via 'subscriberid' Parameter
SendPress Newsletters
≤1.26.1.20No patch available
- High7.5Unauthenticated SQL Injection via 'exclude_posts' Parameter
Social Web Suite – Social Media Auto Post, Social Media Auto Publish
≤4.1.12No patch available
- Critical9.8Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token
Bot for Telegram on WooCommerce
≤1.3.0No patch available
- High8.1Unauthenticated Authentication Bypass to Account Takeover
SSL Wireless SMS Notification
≤3.8.1No patch available
- High7.5Authentication Bypass via SSO Email-Collision Account Binding on Multisite
Wild Apricot Login
≤1.0.18No patch available
- High7.5Authenticated (Contributor+) PHP Object Injection
Dynamic QR Code
≤1.0.1No patch available
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
myPOS Checkout
≤1.4.5No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection
News Kit Addons For Elementor
≤1.5.0No patch available
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Finale Lite – Sales Countdown Timer & Discount for WooCommerce
≤2.21.0No patch available
- High7.5Authenticated (Contributor+) PHP Object Injection
WP Media folders
≤1.1.10No patch available
- High7.5Authenticated (Contributor+) PHP Object Injection
Frisbii Pay
≤1.8.19Update to 1.8.20
- High7.5Authenticated (Author+) PHP Object Injection
Spexo Addons for Elementor – Elementor Widgets, Mega Menu, Popup Builder, Template Kits and Starter Templates for Elementor
≤1.2.3No patch available
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Product Catalog Feed by PixelYourSite
≤3.1.4No patch available
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
FV Flowplayer Video Player
≤7.5.56.7212Update to 7.5.57.7212
- High7.5Authenticated (Contributor+) PHP Object Injection
Social Snap — Social Share Buttons & Click to Tweet
≤1.5.4No patch available