CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 64)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.7Update to 11.2.8
- Medium5.3Missing Authorization
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.0Update to 1.58.1
- Medium4.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.28Update to 1.0.29
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤8.8.8Update to 8.8.9
- Medium4.3Missing Authorization
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.6Update to 7.3.7
- Medium4.3Missing Authorization
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.13Update to 7.5.14
- Medium5.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.28Update to 1.0.29
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetMenu
≤3.0.5Update to 3.0.5.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
≤2.9.2.3Update to 2.9.2.4
- Medium4.3Missing Authorization
Flexible Subscriptions
≤1.8.4Update to 1.8.5
- Medium4.3Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.22Update to 2.9.23
- Medium5.3Missing Authorization
Products Restricted Users for WooCommerce
≤0.7Update to 0.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Custom Query Blocks
≤5.6.0Update to 5.7.0
- Medium4.3Missing Authorization
Event Post
≤6.1.1Update to 6.1.2
- Medium4.3Missing Authorization
VideoWhisper Site Manager for ChatGPT, Claude, Codex, Grok
≤1.2.10Update to 1.2.11
- Medium4.3Missing Authorization
TMDS – Dropshipping for TEMU and Woo
≤1.0.15Update to 1.0.16
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Event Post
≤6.1.1Update to 6.1.2
- High8.1Unauthenticated PHP Object Injection
Motorix
≤1.11No patch available
- High8.1Unauthenticated PHP Object Injection
Meals & Wheels
≤1.1.13No patch available
- High8.1Unauthenticated PHP Object Injection
Gunslinger
≤1.11No patch available
- Medium5.3Missing Authorization
Bus Ticket Booking with Seat Reservation
≤5.9.7Update to 5.9.8
- Medium5.3Missing Authorization
Push Notification for Post and BuddyPress
≤3.23Update to 3.24
- Medium6.6Authenticated (Editor+) PHP Object Injection
Polylang
≤3.8.9Update to 3.8.10
- High8.1Real Estate WordPress Theme <= 1.3.13 - Unauthenticated PHP Object Injection
Good Homes - Real Estate WordPress Theme
≤1.3.13No patch available
- High8.1Gaming Metaverse Game & Crypto WordPress Theme <= 1.19 - Unauthenticated PHP Object Injection
Gamic - Gaming Metaverse Game & Crypto WordPress Theme
≤1.19No patch available
- High8.1Unauthenticated PHP Object Injection
gamezone
≤1.1.11No patch available
- High8.1Unauthenticated PHP Object Injection
EmojiNation
≤1.0.12No patch available
- High8.1Unauthenticated PHP Object Injection
Edge Decor
≤2.9No patch available
- High8.1Unauthenticated PHP Object Injection
Coinpress
≤1.0.15No patch available