CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 72)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
click5 CRM add-on to Gravity Forms
≤1.0.3No patch available
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.1Update to 6.3.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Robo Gallery – Photo & Image Slider
≤5.2.5Update to 5.2.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Robo Gallery – Photo & Image Slider
≤5.2.5Update to 5.2.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetBlocks for Elementor
≤1.5.2.1Update to 1.5.2.2
- Medium5.3Missing Authorization
Scripts n Styles
≤3.5.8No patch available
- Medium4.3Missing Authorization
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
≤3.4.1Update to 3.4.2
- Medium5.3Missing Authorization
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams
≤1.7.1Update to 1.7.2
- Medium4.3Authenticated (Subscriber+) Information Exposure
All Bootstrap Blocks
≤1.3.31No patch available
- Medium4.3Missing Authorization
Before After Image Comparison – Visual Comparison for Two Images
≤1.1.21Update to 1.1.22
- Critical9.8Unauthenticated Privilege Escalation
Tonda Membership
≤1.0.1No patch available
- Medium4.3Missing Authorization
Asgaros Forum
≤3.4.0No patch available
- Medium5.3Unauthenticated Denial of Service
WooCommerce Bookings
≤3.10.0Update to 3.11.0
- Medium4.9Authenticated (Admin+) SQL Injection
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
<4.1.0Update to 4.1.0
- Medium4.3Missing Authorization
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.16.1Update to 1.16.2
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Mobile builder
≤1.4.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Prenotazioni
≤1.7.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Piotnet Forms
≤1.0.30No patch available
- Medium6.1Reflected Cross-Site Scripting
Subscribe to Comments
≤2.3.2Update to 2.3.3
- High7.5Unauthenticated SQL Injection
paymendo – Bank Transfer (Lite)
≤1.1No patch available
- High7.5Unauthenticated SQL Injection
WP Verify API
≤1.0.0No patch available
- High7.5Unauthenticated SQL Injection
ASPL Product Quotation
≤1.1.0No patch available
- High7.5Unauthenticated SQL Injection
WpCues Basic Quiz
≤1.6.5No patch available
- High7.5Unauthenticated SQL Injection
Social Web Suite – Social Media Auto Post, Social Media Auto Publish
≤4.1.12No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Topcontent
≤1.2.1No patch available
- Low3.1Information Exposure
Simple Membership
≤4.8.2Update to 4.8.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Adwised Web Push Notification
≤2.5.7No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Web Vitals Tracking
≤5.4.2No patch available
- High8.8Authenticated (Crowdfundly Manager+) Privilege Escalation
Crowdfundly
≤2.2.2No patch available
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Freeton WP
≤1.0.0No patch available