CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 67)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Author Name
WP Meteor Website Speed Optimization Addon
≤3.4.18Update to 3.4.19
- Medium5.4Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.5Update to 6.2.6
- High7.2Authenticated (Custom+) PHP Object Injection via 'value' Parameter
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Critical9.1Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter
PPOM – Product Addons & Custom Fields for WooCommerce
≤34.0.10Update to 34.0.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
ACF Frontend Admin by DynamiApps
≤3.28.36Update to 3.29.1
- High8.1Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions
WP File Download
≤6.3.9Update to 6.3.10
- Medium6.1Reflected Cross-Site Scripting via 'fvrt_' prefix
Favicon Rotator
≤1.2.11Update to 1.2.12
- Medium5.3Missing Authorization to Unauthenticated PNG File Upload
WP CV Builder
≤1.3.1Update to 1.3.2
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter
WP Booking System – Booking Calendar
≤2.1.0.1Update to 2.1.0.2
- Medium6.1Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment
Payment Plugins for Stripe WooCommerce
≤4.0.17Update to 4.0.18
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter
Revopic – Photo Reviews for WooCommerce
≤1.2.30Update to 1.2.31
- High7.2Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter
VikBooking Hotel Booking Engine & PMS
≤1.8.15Update to 1.8.16
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Author Name
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.34.8Update to 2.34.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode
Team – Team Members Showcase Plugin
≤6.0.2Update to 6.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting via display_name User Field
Post Grid Gutenberg Blocks – PostX
≤5.1.0Update to 5.1.1
- Low3.7Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check
SpeedyCache – Cache, Optimization, Performance
≤1.4.2Update to 1.4.3
- Medium6.5Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)
SiteOrigin Widgets Bundle
≤1.74.3Update to 1.75.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field
Simple Membership
≤4.8.4Update to 4.8.5
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
LazyLoad Plugin – Lazy Load Images, Videos, and Iframes
≤2.4.0Update to 2.4.1
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute
Responsive Lightbox & Gallery
≤2.7.9Update to 2.7.10
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.6Update to 11.2.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag
Presto Player
≤4.5.1Update to 4.5.2
- Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json
Post Export Import with Media
≤1.17.1Update to 1.17.2
- Medium4.9Authenticated (Administrator+) SQL Injection via 'sidx' Parameter
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation
≤1.13.2Update to 1.13.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook
Podlove Podcast Publisher
≤4.5.6Update to 4.5.7
- Medium5.3Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()
Order Export & Order Import for WooCommerce
≤2.7.8Update to 2.7.9
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot
Noptin – Newsletter, New Post Notifications & Email Automation
≤4.3.10Update to 4.4.0
- High7.5Unauthenticated Arbitrary File Read via 'f' Parameter
Music Store – WordPress eCommerce
≤1.4.7Update to 1.4.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
≤5.14.2Update to 5.15
- High8.8Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
≤10.2.1Update to 10.3.0