CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 112)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
≤2.1.71Update to 2.1.72
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPeMatico RSS Feed Fetcher
≤2.8.25Update to 2.8.26
- Medium5.3Missing Authorization to Account Registration
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium4.3Unauthenticated (Subscriber+) Unauthorized Course Enrollment
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium4.3Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium4.3Authenticated (Subscriber+) Information Exposure
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤3.4.1Update to 3.4.2
- High7.5Authenticated (Subscriber+) PHP Object Injection
wpForo Forum
≤3.1.5Update to 3.1.6
- Medium4.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
≤2.1.71Update to 2.1.72
- High8.1Unauthenticated PHP Object Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.3Update to 3.15.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Text Styler
≤1.1.1No patch available
- Medium5.3Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.19Update to 2.9.20
- Medium4.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
≤2.1.71Update to 2.1.72
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Refund Requests
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
≤2.1.71Update to 2.1.72
- High7.2Unauthenticated Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.3Update to 3.15.4
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
WPeMatico RSS Feed Fetcher
≤2.8.25Update to 2.8.26
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPeMatico RSS Feed Fetcher
≤2.8.25Update to 2.8.26
- Medium4.3Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
≤7.9.4Update to 7.9.5
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤3.4.1Update to 3.4.2
- Medium5.33.1.5 - Unauthenticated AI Credit Exhaustion
wpForo Forum
3.0.0 – 3.1.5Update to 3.1.6
- Medium4.3Missing Authorization
CMB2
≤2.12.0Update to 2.13.0
- Medium4.9Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels
≤6.6.43Update to 6.6.44
- High7.5Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
≤6.8.0Update to 6.8.1
- Medium5.3Missing Authorization to Unauthenticated Arbitrary API Key Deletion via 'clear_api_type' Parameter
PixelPlay
≤1.0.2No patch available
- Medium5.3Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay_api' Parameter
Image Buzz
≤1.0.3No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Deletion
BM Content Builder
<3.17.1Update to 3.17.1
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe_publishbale_key' Parameter
Handily
≤1.0.3Update to 1.0.4
- Medium6.5Authenticated (Subscriber+) Arbitrary File Read
BM Content Builder
<3.17.1Update to 3.17.1
- Medium4.3Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter
WP-CRM System – Manage Clients and Projects
≤3.4.6Update to 3.4.7
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation
ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More
≤6.2.1Update to 6.2.2