CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 56)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
ACF Frontend Admin by DynamiApps
≤3.29.0Update to 3.30.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content
Cooked – Recipe Management
≤1.16.1Update to 1.16.2
- Medium5.32.9.19 - Unauthenticated Payment Bypass
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
2.9 – 2.9.19Update to 2.9.20
- Medium5.3Unauthenticated Information Exposure
MAIO – ChatGPT SEO Tracking & AI Search Optimization
≤7.3.21Update to 7.3.22
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
≤5.5.87Update to 5.5.88
- Medium5.31.120.69 - Unauthenticated Information Exposure
PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)
1.117.9 – 1.120.69Update to 1.120.70
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure
Blog2Social: Social Media Auto Post & Scheduler
≤9.1.4Update to 9.1.5
- Medium4.3Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters
Elementor Website Builder – more than just a page builder
≤4.2.3Update to 4.2.4
- High7.2Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter
Mang Board
≤2.4.0Update to 2.4.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template
Ocean Extra
≤2.6.0Update to 2.6.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature
VK Blocks
≤1.126.1Update to 1.126.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor
≤1.27.13Update to 1.27.14
- High7.2Unauthenticated Stored Cross-Site Scripting via 'order_email'
Premium Packages – Sell Digital Products Securely
≤7.0.5Update to 7.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.5.14Update to 4.5.15
- Medium6.1Reflected Cross-Site Scripting via 'title' Parameter
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.42Update to 1.8.43
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields
Import and export users and customers
≤2.4.5Update to 2.4.6
- High8.1Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion via Checkout File Field Attachment ID
Checkout Field Manager (Checkout Manager) for WooCommerce
≤7.9.6Update to 7.9.7
- Medium6.1Reflected Cross-Site Scripting via 'TCM_ErrorMessages'
Tracking Code Manager
≤2.6.0Update to 2.7.0
- High7.5Unauthenticated SQL Injection via 'link_url' Parameter
Link Library
≤7.9.2Update to 7.9.3
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.2.0Update to 6.2.1
- High7.3Unauthenticated Server-Side Request Forgery via 'src' Parameter
PhastPress
≤3.10Update to 3.11
- Critical9.8Unauthenticated Arbitrary File Upload via 'page_id' Parameter
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.34.10Update to 2.34.11
- Critical9.8Unauthenticated Remote Code Execution
The Grid
≤2.8.1Update to 2.8.2
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter
FV Flowplayer Video Player
≤7.5.54.7212Update to 7.5.55.7212
- Medium4.3Authenticated (Subscriber+) Information Exposure
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.2Update to 10.31.3
- Medium6.42.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Pricing Table – Block – Show Product or Service Pricing in Table Format
1.0.7 – 2.1.4Update to 2.1.5
- Medium5.3Missing Authorization
Patreon WordPress
≤1.9.0Update to 1.10.0
- High8.8Authenticated (Contributor+) Remote Code Execution
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
<3.9.1Update to 3.9.1
- Medium5.3Missing Authorization
Robokassa payment gateway for Woocommerce
<1.9.0Update to 1.9.0
- High7.3Missing Authorization to Unauthenticated Settings Modification
LTL Freight Quotes – ODFL Edition
<4.2.19Update to 4.2.19