CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 108)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Kadence WooCommerce Email Designer
≤1.5.19.1Update to 1.5.19.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing
≤1.69.0Update to 1.69.1
- Medium5.3Missing Authorization
Simply Schedule Appointments
≤1.6.12.29Update to 1.6.12.31
- Medium5.3Unauthenticated Payment Bypass
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management
≤4.6.25Update to 4.6.26
- Medium6.52.0.2 - Unauthenticated Arbitrary Shortcode Execution
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
1.5.0.1 – 2.0.2Update to 2.0.2.1
- High8.15.3.6 - Unauthenticated Local File Inclusion
WebFacing™ – Email Accounts management for cPanel®
5.3 – 5.3.6Update to 5.4
- Medium5.38.0.4 - Unauthenticated Information Exposure
File Manager
7.2.2 – 8.0.4Update to 8.0.5
- Medium6.4Authenticated (Listing Admin+) Stored Cross-Site Scripting
WP Directory Kit
≤1.5.7Update to 1.5.8
- High7.2Unauthenticated Stored Cross-Site Scripting
LayerSlider
≤8.4.0Update to 8.4.1
- Medium5.3Missing Authorization
Blocksy Companion
≤2.1.55Update to 2.1.56
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
JetEngine
≤3.8.14.3Update to 3.8.15
- High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine
≤3.8.14.3Update to 3.8.15
- High7.2Unauthenticated Stored Cross-Site Scripting
ThemeREX Addons
<2.45.0Update to 2.45.0
- Medium5.3Unauthenticated User Impersonation
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.9Update to 4.17.0
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar
≤6.5.0Update to 6.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.85Update to 51.1.86
- High7.2Unauthenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.9Update to 4.17.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤6.5.1Update to 6.5.2
- Medium6.5Authenticated (Editor+) Arbitrary File Deletion
Template Kit – Import
≤1.0.16Update to 1.0.17
- Medium4.3Cross-Site Request Forgery
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP
≤1.8.1Update to 1.8.2
- Medium5.3Missing Authorization
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.2Update to 4.0.3
- High7.5Authenticated (Contributor+) PHP Object Injection
Go Live Update Urls
≤7.0.8Update to 7.1.0
- High7.5Authenticated (Contributor+) PHP Object Injection
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.33.6Update to 2.34.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Site Reviews
≤8.3.1Update to 8.3.2
- High7.5Authenticated (Contributor+) PHP Object Injection
GEO Plugin by Squirrly SEO
≤14.2.5Update to 14.2.6
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤14.16.13Update to 14.16.14
- High7.2Unauthenticated Stored Cross-Site Scripting
Parsi Date | بسته فارسی ساز وردپرس و ووکامرس پارسی دیت
≤6.3Update to 6.4