CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 109)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Import and export users and customers
≤2.5.2Update to 2.5.4
- High7.5Unauthenticated Arbitrary File Read
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.5.0Update to 4.5.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)
≤1.10.7Update to 1.10.8
- Medium6.1Reflected Cross-Site Scripting
File Manager
≤8.0.4Update to 8.0.5
- Medium6.5Authenticated (Subscriber+) SQL Injection
WP Review Slider Pro
≤12.7.11Update to 12.7.12
- Medium4.3Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion
MailerLite – Signup forms (official)
≤1.7.21Update to 1.7.22
- Medium6.5Missing Authorization to Unauthenticated Settings Export and Settings Reset
Custom Thank You Page for WooCommerce
≤1.1.2Update to 1.1.3
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure
Spectra Legacy – Gutenberg Blocks
≤2.20.0Update to 2.20.1
- Medium5.4Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.2.0Update to 6.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
WP Multilang – Translation and Multilingual Plugin
≤2.4.31Update to 2.4.32
- Critical9.8Unauthenticated Local File Inclusion via 'vcv-template' Parameter
Visual Composer Website Builder
≤45.16.0Update to 45.16.1
- High8.8Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route
YOP Poll
≤7.0.10Update to 7.0.11
- High7.5Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter
eesy_ID2WP – Publish InDesign HTML5
≤1.0.3Update to 1.0.4
- Medium4.9Authenticated (Editor+) SQL Injection
W4 Post List
≤3.0.6Update to 3.0.7
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP
≤2.1.7Update to 2.1.8
- Medium5.3Unauthenticated Insecure Direct Object Reference
Team – Team Members Showcase Plugin
≤6.0.0Update to 6.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ditty – Responsive News Tickers, Sliders, and Lists
≤3.1.69Update to 3.1.70
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetTricks
≤2.0.1Update to 2.0.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.7.8Update to 3.7.9
- Medium4.3Cross-Site Request Forgery
PublishPress Capabilities: User Role Access Control, Admin Area Permissions
≤2.50.1Update to 2.51.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
≤7.9.5Update to 7.9.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.105Update to 4.11.106
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤4.0.5Update to 4.0.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Podcast Importer SecondLine
≤1.5.6Update to 1.5.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ultimate FAQ Accordion Plugin
≤2.4.14Update to 2.5.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Core Web Vitals & PageSpeed Booster
≤1.0.31Update to 1.0.32
- Medium5.3Missing Authorization
PayPlus Payment Gateway
≤8.2.5Update to 8.2.6
- Critical9.8Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter
Paytium: Mollie payment forms & donations
≤5.0.3Update to 5.0.4
- Medium6.5Authenticated (Subscriber+) SQL Injection
Tainacan
≤1.2.0Update to 1.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Razorpay Payment Button Plugin
≤2.4.9Update to 2.5.0