CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 66)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.3Unauthenticated Arbitrary Shortcode Execution
Salevo Boost Sales for WooCommerce – Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon
≤1.3.0Update to 1.3.1
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Disclosure
Booster Elite for WooCommerce
<8.4.0Update to 8.4.0
- Medium6.1Reflected Cross-Site Scripting
Marin
≤0.1.1Update to 0.1.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
HireZoot – Job Listings, Career Page & Recruitment Tool
≤3.0.0Update to 4.0.0
- Medium4.3Missing Authorization
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
≤5.0.19No patch available
- Medium4.37.1 - Missing Authorization
WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments
6.1 – 7.1Update to 7.2
- Medium4.3Missing Authorization
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce
≤2.2.4Update to 2.2.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute
PeproDev Ultimate Profile Solutions
≤8.2.36Update to 8.2.37
- High7.2Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.31Update to 1.7.32
- Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter
Listdom: AI-powered Business Directory with Classifieds Ads Listings
≤6.1.2Update to 6.2.0
- High7.5Unauthenticated Arbitrary File Read via 'svg_image' Parameter
Divi Plus
≤2.4.0Update to 2.4.1
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute
Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress
≤5.2.12Update to 5.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
≤3.16.0.5Update to 3.16.0.6
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
≤5.8.4Update to 5.8.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field
Avada | Website Builder For WordPress & WooCommerce
≤7.16.1Update to 7.16.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter
WPAdverts – Classifieds Plugin
≤2.3.4Update to 2.3.5
- High7.5Unauthenticated SQL Injection via 'booking[service_id]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint
Email Marketing for WordPress and WooCommerce – Retainful
≤1.0.10Update to 1.0.11
- Medium6.4Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content
SureDash – Community, Courses & Member Dashboard
≤1.12.1Update to 1.12.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
≤44.1Update to 45.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter
Motors – Car Dealership & Classified Listings Plugin
≤1.4.124Update to 1.4.125
- High7.5Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
≤5.0.2Update to 5.0.3
- High8.1Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
≤44.1Update to 45.0
- Medium4.7Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
≤2.0.2.1Update to 2.0.2.2
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)
WP Directory Kit
≤1.5.9Update to 1.6.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter
Premium Packages – Sell Digital Products Securely
≤7.2.6Update to 7.2.7
- Critical9.8Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback
WPCOM Member
≤1.7.27Update to 1.8.0
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.1Update to 6.3.2
- High7.2Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History
WP Photo Album Plus
≤9.3.03.002Update to 9.3.03.003
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.12Update to 4.3.13