CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 63)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Books Gallery – Book Showcase, Library & Affiliate Plugin
≤4.8.4Update to 4.8.5
- Medium4.9Authenticated (Editor+) SQL Injection
WOLF – WordPress Posts Bulk Editor and Manager Professional
≤1.1.1Update to 1.1.2
- Medium5.3Missing Authorization
FOX – Currency Switcher Professional for WooCommerce
≤1.5.4Update to 1.5.5
- Medium5.3Unauthenticated Information Exposure
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium5.3Missing Authorization
Spin Wheel – Interactive spinning wheel that offers coupons
≤2.2.0Update to 2.2.1
- Medium4.3Authenticated (Subscriber+) Information Exposure
Visual Form Builder
≤3.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium6.1Reflected Cross-Site Scripting
XStore
<9.7.9Update to 9.7.9
- Medium4.3Missing Authorization
Easy HTTPS Redirection (SSL)
≤2.0.1Update to 2.0.2
- High7.5Unauthenticated SQL Injection
Mobile builder
≤1.4.2No patch available
- Medium5.33.4.1 - Unauthenticated Arbitrary Order Status Manipulation
Cardinity Payment Gateway for WooCommerce
3.2.6 – 3.4.1Update to 3.4.2
- Medium5.3Unauthenticated Payment Bypass
Coinbase Commerce Payment Gateway for WooCommerce
≤1.4.1No patch available
- Medium5.3Missing Authorization
eaSYNC Booking – Hotels, Restaurants & Car Rentals
≤1.3.30Update to 1.3.31
- Medium4.3Cross-Site Request Forgery
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium5.3Unauthenticated Arbitrary HTML Attribute Injection
Broken Link Checker
≤2.4.14.1Update to 2.4.15
- High7.2Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback
Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
≤2.10.6Update to 2.10.7
- Medium4.9Authenticated (Editor+) SQL Injection via 'counterid' Parameter
Animated Number Counters
≤3.0Update to 3.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤11.1.0Update to 11.1.1
- Medium4.3Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- Medium4.3Missing Authorization
WP-Members Membership Plugin
≤3.5.7Update to 3.5.8
- Medium5.3Missing Authorization
Skydropx
≤2.1.4Update to 2.1.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management
≤4.6.27Update to 4.6.28
- Medium6.1Reflected Cross-Site Scripting
Hippoo Mobile App for WooCommerce
≤1.12.0Update to 1.12.1
- Medium6.1Reflected Cross-Site Scripting
SimplyRETS Real Estate IDX
≤3.2.9Update to 3.3.0
- Critical9.8Unauthenticated Remote Code Execution
MDTF – Meta Data and Taxonomies Filter
≤1.3.9Update to 1.4.0
- Medium4.3Cross-Site Request Forgery
Patreon WordPress
≤1.9.17Update to 1.10.0
- Medium4.3Cross-Site Request Forgery
Patreon WordPress
≤1.10.0Update to 1.11.0
- Medium5.3Missing Authorization
Salevo Boost Sales for WooCommerce – Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon
≤1.3.0Update to 1.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.110Update to 4.11.111