CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 110)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Podcast Importer SecondLine
≤1.5.6Update to 1.5.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ultimate FAQ Accordion Plugin
≤2.4.14Update to 2.5.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Core Web Vitals & PageSpeed Booster
≤1.0.31Update to 1.0.32
- Medium5.3Missing Authorization
PayPlus Payment Gateway
≤8.2.5Update to 8.2.6
- Critical9.8Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter
Paytium: Mollie payment forms & donations
≤5.0.3Update to 5.0.4
- Medium6.5Authenticated (Subscriber+) SQL Injection
Tainacan
≤1.2.0Update to 1.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Razorpay Payment Button Plugin
≤2.4.9Update to 2.5.0
- Medium5.3Missing Authorization
Online Booking & Scheduling Calendar by vcita
≤4.6.0Update to 4.6.3
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Reycob Product Import Export
≤2.3.0Update to 2.4.0
- Medium5.3Missing Authorization
Tangible: Loops & Logic
≤4.2.4Update to 4.3.0
- Medium5.3Missing Authorization
Conekta Payment Gateway
≤6.2.4Update to 6.2.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Mang Board
≤2.4.1Update to 2.4.2
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Photo Album Plus
≤9.3.02.002Update to 9.3.02.003
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
wpForo Forum
≤3.1.5Update to 3.1.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤5.5.1.1Update to 5.5.1.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Event Tickets and Registration
≤5.29.4Update to 5.29.5
- High7.2Unauthenticated Stored Cross-Site Scripting
WPS Limit Login
≤1.5.9.3Update to 1.5.9.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
PixelYourSite – Your smart PIXEL (TAG) & API Manager
≤11.4.1Update to 11.4.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.3Update to 3.15.4
- Medium5.3Missing Authorization
AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker)
≤3.15.4Update to 3.15.5
- Medium4.9Authenticated (Editor+) SQL Injection
Ultimeter – the Ultimate Progress and Goals Meter
≤3.0.8Update to 3.1.0
- Medium4.9Authenticated (Administrator+) SQL Injection
Email Log
≤2.63Update to 2.64
- Medium6.5Authenticated (Contributor+) SQL Injection
WP EasyCart: Shopping Cart and eCommerce Store
≤5.9.4Update to 6.0.0
- Medium6.5Authenticated (Contributor+) SQL Injection
Mollie Forms
≤2.11.0Update to 2.11.1
- Medium6.5Authenticated (Contributor+) SQL Injection
Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator
≤1.5.10Update to 1.5.11
- Medium4.3Missing Authorization
Fluent Support – Helpdesk & Customer Support Ticket System
≤2.3.2Update to 2.4.0
- Medium4.9Authenticated (Shop Manager+) SQL Injection
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.7.0Update to 3.7.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Blocks – Gutenberg Blocks, Patterns & Templates
≤2.3.17Update to 2.3.18
- High8.8Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields
Import and export users and customers
≤2.4.17Update to 2.4.18
- Medium5.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
≤2.1.70Update to 2.1.72