CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 55)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.1Update to 1.58.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.1Update to 1.58.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via parser_callback
Broken Link Checker
≤2.4.14.1Update to 2.4.15
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow
Bulk Page Generator – LPagery
≤3.1.0Update to 3.1.1
- Medium6.5Authenticated (Custom+) SQL Injection via 'filters' Parameter
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
≤1.31.4Update to 1.31.5
- High7.5Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting
InstaWP Connect – 1-click WP Staging & Migration
≤0.1.4.1Update to 0.1.4.2
- High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint
Klarna for WooCommerce
≤4.13.3Update to 4.13.4
- Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML
Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy
≤1.2.0Update to 1.3.0
- High8.1Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.9.3Update to 4.9.4
- Medium6.1Reflected Cross-Site Scripting via 'permalink' Parameter
Gwolle Guestbook
≤5.1.1Update to 5.1.2
- High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
≤3.16.0.6Update to 3.17.0
- High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters
FluentCart – Online Store Builder & eCommerce Checkout
≤1.7.0Update to 1.7.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
Flying Scripts: Delay JavaScript to Improve Site Speed & Performance
≤1.2.4Update to 1.2.5
- Medium4.9Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys
FluentCart – Online Store Builder & eCommerce Checkout
≤1.7.0Update to 1.7.1
- High7.2Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
≤5.2.11Update to 5.2.12
- High8.1Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter
Customer Email Verification for WooCommerce
≤3.3.0Update to 3.3.1
- Medium4.3Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id}
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.2.1Update to 5.3.0
- Medium5.9Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link>
Debloat – Remove Unused CSS, Optimize JS
≤1.3.0Update to 1.4.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter
Complianz GDPR/CCPA Cookie Consent Banner
≤7.5.5Update to 7.5.6
- High7.2Unauthenticated Stored Cross-Site Scripting via Comments
Colibri Page Builder
≤1.0.390Update to 1.0.392
- High8.0Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation
Backuply – Backup, Restore, Migrate and Clone
≤1.5.8Update to 1.5.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute
Dark Mode – Improve Accessibility with AI Powered Dark Theme
≤5.3.17Update to 5.3.18
- Medium4.86.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
6.4.1 – 6.4.2Update to 6.4.3
- Medium5.3Unauthenticated Information Exposure
Gantry 5 Framework
≤5.6.4Update to 5.6.5
- Medium6.1Reflected Cross-Site Scripting
Fancy Comments WordPress
≤1.2.21No patch available
- Medium4.3Missing Authorization
Squeeze – Browser-Based Image Compression & WebP Converter (No API, No Limits)
≤1.8.0Update to 1.8.1
- Medium5.3Unauthenticated Reduced Booking Price
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
≤2.8.0Update to 2.8.1
- Medium5.3Unauthenticated Information Exposure
ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
≤3.12.0Update to 3.12.1
- Medium5.3Missing Authorization
PickPlugins Product Designer for WooCommerce
≤1.0.40No patch available
- Medium6.6Authenticated (Administrator+) PHP Object Injection
ACF Frontend Admin by DynamiApps
≤3.29.0Update to 3.30.0