CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 69)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.188Update to 2.8.189
- Critical9.1Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field
Avada (Fusion) Builder
≤3.16.1Update to 3.16.2
- Medium5.4Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site
Hello Plus
≤1.7.7Update to 1.7.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute
FV Flowplayer Video Player
≤7.5.54.7212Update to 7.5.55.7212
- Medium6.1Reflected Cross-Site Scripting via 'inputs' Parameter Array Key
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.48Update to 1.15.49
- Medium4.7Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.14Update to 6.2.15
- Medium5.3Authenticated (Author+) SQL Injection via FireBox Form Display Condition
FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment
≤3.1.13Update to 3.1.14
- Medium6.1Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL
Filter Everything — WordPress & WooCommerce Filters
≤1.9.6Update to 1.9.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title>
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
≤5.2.10Update to 5.2.11
- High7.2Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting
Fastcache by Host.it
≤1.7.4Update to 1.7.5
- Critical9.8Unauthenticated Remote Code Execution via 'xpv_image' Parameter
3D Product configurator for WooCommerce
≤2.16.2Update to 2.16.3
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex
Anti-Spam, Spam FireWall by CleanTalk
≤6.88Update to 6.89
- Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email
Download Manager
≤3.3.71Update to 3.3.72
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute
Download Manager
≤3.3.71Update to 3.3.72
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action
Data Tables Generator by Supsystic – Excel-like, WooCommerce & Pricing Tables
≤1.15.1Update to 1.15.3
- High7.5Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files[tmp_name]' Parameter
rtMedia for WordPress, BuddyPress and bbPress
≤4.7.13Update to 4.7.14
- Critical9.8Unauthenticated Arbitrary File Upload via Signature Field File Upload
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)
≤3.4.5Update to 3.4.6
- Medium6.8Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body
Online Scheduling and Appointment Booking System – Bookly
≤28.4Update to 28.5
- Medium5.3Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details
Online Scheduling and Appointment Booking System – Bookly
≤28.4Update to 28.5
- Critical9.1Unauthenticated Privilege Escalation to 'role' Parameter
Blocksy Companion
≤2.1.58Update to 2.1.59
- Critical9.8Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler
Advanced IP Blocker
≤8.13.13Update to 8.13.14
- High8.1Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action
Advanced Form Integration — Connect Forms to 300+ Apps
≤2.9.0Update to 2.10.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value
Table Field Add-on for ACF and SCF
≤1.4.1-RC2Update to 1.4.1
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameter
Advanced Classifieds & Directory Pro
≤3.4.4Update to 3.5.0
- Medium6.5Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
≤4.0.3Update to 4.0.4
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
CodeBard Help Desk
≤1.1.2No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
Tailored Tools
≤3.0.3Update to 3.0.5
- Medium5.3Unauthenticated Information Exposure
DTX – Dynamic Text Extension for Contact Form 7
≤5.0.7No patch available
- High7.5Unauthenticated SQL Injection
Directory Listings WordPress plugin – uListing
≤2.2.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Team Section Block – Showcase Team Members with Layout Options
≤2.0.4Update to 2.0.5