CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 53)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.32Update to 1.8.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.32Update to 1.8.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attribute
WebberZone Top 10 — Popular Posts
≤4.5.2Update to 4.5.3
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension
YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports
≤2.7.7Update to 2.7.8
- Medium6.8Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action
Photo Engine (Media Organizer & Lightroom)
≤6.5.6Update to 6.5.7
- Medium5.4Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import
WPeMatico RSS Feed Fetcher
≤2.9Update to 2.9.1
- Medium6.5Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool
WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents
≤2.9.5Update to 2.9.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MDTF – Meta Data and Taxonomies Filter
≤1.4.0Update to 1.4.1
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Simply Schedule Appointments
≤1.6.12.35Update to 1.6.12.37
- Medium4.3Missing Authorization
WordLift – AI powered SEO – Schema
≤3.54.15Update to 3.54.17
- Medium4.3Missing Authorization
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.8.3Update to 3.8.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetSmartFilters
≤3.8.6Update to 3.8.6.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes
Premium Packages – Sell Digital Products Securely
≤7.2.8Update to 7.3.0
- Medium5.3Missing Authorization
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce
≤4.7.5Update to 4.7.6
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)
WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)
≤1.1.9Update to 1.2.0
- Medium4.3Missing Authorization
Strong Testimonials
≤3.3.12Update to 3.3.13
- Low2.7Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email
WP Mail Logging
≤1.17.0Update to 1.17.1
- High8.8Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action
WP Photo Album Plus
≤9.3.02.002Update to 9.3.02.003
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints
WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters
≤3.0.0Update to 3.1.0
- Medium5.3Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard
≤1.4.5Update to 1.4.6
- Medium4.9Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
WP Booking System – Booking Calendar
≤2.1.0.1Update to 2.1.0.2
- Medium4.8Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint
WP Compress – Instant Performance & Speed Optimization
≤7.25.00Update to 7.26.00
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium6.5Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator
Vitepos – Point of Sale (POS) for WooCommerce
≤3.6.1Update to 3.6.2
- High7.2Unauthenticated Stored Cross-Site Scripting via File Upload
Ultra Addons for Contact Form 7
≤3.5.54Update to 3.5.55
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental
≤3.0.1Update to 3.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental
≤3.0.1Update to 3.0.2
- High8.0Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption
Search Regex
≤3.5Update to 3.5.1
- Critical9.8Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter
Theme My Login
≤7.2.1Update to 7.2.2
- High7.5Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.34.5Update to 2.34.8