CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 62)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Information Exposure
Subscribe to Comments
≤2.3.2Update to 2.3.3
- Critical9.8Unauthenticated Arbitrary File Upload
WP-BusinessDirectory – Business directory plugin for WordPress
≤4.0.2No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
WP Testimonials
≤1.4.13No patch available
- Medium5.3Unauthenticated Information Exposure
Document Gallery
≤5.1.1Update to 5.1.2
- Medium5.35.1.1 - Unauthenticated Document Thumbnail Replacement
Document Gallery
4.1 – 5.1.1Update to 5.1.2
- Medium6.45.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Document Gallery
4.0 – 5.1.1Update to 5.1.2
- Medium6.1Reflected Cross-Site Scripting
Document Gallery
≤5.1.1Update to 5.1.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
MLS On The Fly
≤1.8.1.5No patch available
- Critical9.8Unauthenticated Remote Code Execution
AjaxLoadMore Cache
≤3.1.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Weaver Xtreme Theme Support
≤7.0.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
IMPress for IDX Broker
≤3.3.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
FV Simpler SEO
≤1.9.7Update to 1.9.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Responsive Slider
≤0.1.9No patch available
- High8.1Unauthenticated PHP Object Injection
Quirky - NFT, Token & Artist Marketplace WordPress Theme
≤1.23No patch available
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.25Update to 4.1.26
- Medium4.3Missing Authorization
Download Monitor integration for WooCommerce
≤1.0.3Update to 1.0.4
- Medium5.3Missing Authorization
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.110Update to 4.11.111
- Medium5.3Unauthenticated Information Exposure
WPGraphQL
≤2.26.0Update to 2.26.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.4Update to 4.9.5
- Medium4.3Missing Authorization
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
≤2.1.0Update to 2.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons
≤4.7.1Update to 4.7.2
- Medium4.9Authenticated (Editor+) SQL Injection
Link Whisper Free
≤0.9.7Update to 0.9.8
- Medium5.3Missing Authorization
Booking for Appointments and Events Calendar – Amelia
≤2.4.10Update to 2.4.11
- High7.3Unauthenticated Privilege Escalation
User Rights Access Manager
≤1.1.3No patch available
- Medium5.3Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.23Update to 2.9.24
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.12.7Update to 2.12.8
- Medium5.3Missing Authorization
Quick PayPal Payments: Payment Button & Form
≤6.0.3Update to 6.0.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.110Update to 4.11.111
- Medium5.3Unauthenticated Information Exposure
Active Woot Products Tables for WooCommerce. 100% FREE
≤2.1.3Update to 2.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤3.1.0Update to 3.1.1