CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 103)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.7Unauthenticated Open Redirect
Safe Redirect Manager
≤2.2.0Update to 2.3.0
- High7.5Authenticated (Author+) PHP Object Injection
Minimum and Maximum Quantity for WooCommerce
≤2.1.2Update to 2.1.3
- Medium5.3Unauthenticated Unauthorized Subscription Activation
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.0.9Update to 3.1.0
- High8.1Unauthenticated PHP Object Injection
Booking Activities
≤1.18.7.1Update to 1.18.8
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Content Egg – Affiliate Product Importer & Price Comparison
≤6.3.1Update to 11.9.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Trusted Shops Easy Integration for WooCommerce
≤2.0.6Update to 2.0.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Classified Listing – AI-Powered Classified ads & Business Directory
≤6.1.3Update to 6.1.5
- High7.5Authenticated (Custom Role+) PHP Object Injection
eCommerce Product Catalog
≤3.6.0Update to 3.6.1
- High7.5Authenticated (Custom Role+) PHP Object Injection
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
≤1.17.9Update to 1.17.10
- High7.5Authenticated (Contributor+) PHP Object Injection
DesignSetGo
≤2.8.0Update to 2.8.1
- Medium5.3Missing Authorization
GravityExport Lite for Gravity Forms
≤2.7.2Update to 2.7.3
- Medium5.31.9.7 - Missing Authorization
InPost PL
1.7.5 – 1.9.7Update to 1.9.8
- Medium6.12.8.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Mobile Menu – The Mobile-Friendly Responsive Menu
2.7.4 – 2.8.8Update to 2.9
- High7.58.7.7 - Authenticated (Author+) PHP Object Injection
EWWW Image Optimizer
8.6.0 – 8.7.7Update to 8.8.0
- Medium5.32.0.6 - Unauthenticated Access Mode Bypass
WPEPP – All In One WordPress Security, Firewall, Malware Scanner & Login Protection
2.0.0 – 2.0.6Update to 2.0.7
- Medium4.3Missing Authorization
Vayu X
≤1.0.5Update to 1.0.6
- Medium5.3Unauthenticated Information Exposure
Connections Business Directory
≤10.4.67No patch available
- High7.22.0.16 - Unauthenticated Stored Cross-Site Scripting via SVG Upload
All in One Files Upload for WooCommerce
2.0.3 – 2.0.16Update to 2.0.17
- Medium5.33.2.9 - Unauthenticated Information Exposure
New User Approve
3.1.0 – 3.2.9Update to 3.2.10
- Medium5.3Unauthenticated Information Exposure
Solace Extra
≤1.7.1Update to 1.7.2
- Medium4.3Authenticated (Subscriber+) Subscription-Gated Post Creation
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.11Update to 4.3.12
- Medium5.34.3.11 - Missing Authorization
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
2.5.8 – 4.3.11Update to 4.3.12
- Medium4.7Cross-Site Scripting to Unauthenticated Arbitrary HTML Content Injection in Admin Log
WP Mail Logging
≤1.16.0Update to 1.17.0
- High7.3Unauthenticated Unauthorized Customer Account Access
FluentCart – Online Store Builder & eCommerce Checkout
≤1.6.4Update to 1.6.5
- Medium5.32.0.5 - Unauthenticated Arbitrary Payment Amount Reduction
Easy PayPal & Stripe Buy Now Button
1.8 – 2.0.5Update to 2.0.6
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
Schema & Structured Data for WP & AMP
≤1.66Update to 1.67
- High7.22.0.0 - Unauthenticated Server-Side Request Forgery
Broken Link Notifier
1.3.1 – 2.0.0Update to 2.0.0.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
YITH WooCommerce Tab Manager
≤2.15.0Update to 2.15.1
- Medium5.3Unauthenticated Information Exposure
Course Booking System
≤7.0.8Update to 7.0.9
- High7.5Authenticated (Contributor+) PHP Object Injection
Themify Builder
≤7.8.1Update to 7.8.2