CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 1245)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Authenticated Stored Cross-Site Scripting
iQ Block Country
≤1.2.11Update to 1.2.12
- Medium6.4Unprotected REST-API to Email Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.5.7Update to 3.5.8
- Medium6.5Unprotected REST-API to Sensitive Information Disclosure
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.5.7Update to 3.5.8
- High7.5Arbitrary User Password Reset
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.6.2Update to 2.6.3
- Medium4.8Admin+ Stored Cross-Site Scripting
Cookie Bar
≤1.8.8Update to 1.8.9
- Medium5.4Cross-Site Scripting
Video Player for YouTube – Embed Videos Your Visitors Will Love to Watch
<1.4Update to 1.4
- Medium5.4Contributor+ Stored Cross-Site Scripting
Easy Media Download
≤1.1.5Update to 1.1.7
- Medium5.8Open Relay and Server-Side Request Forgery
Telefication
≤1.8.0No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Responsive WordPress Slider
≤2.2.0No patch available
- Medium4.8Vimeo and YouTube Gallery < 1.1.5 - Stored Cross-Site Scripting
Video Gallery – Vimeo and YouTube Gallery
<1.1.5Update to 1.1.5
- High8.8Cross-Site Request Forgery
jQuery Reply to Comment
≤1.31No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Special Text Boxes
≤5.9.109Update to 5.9.110
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Frontend Uploader
≤1.3.2No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
St-Daily-Tip
≤4.7No patch available
- High7.2Authenticated (Admin+) SQL Injection
Game Server Status
≤1.0No patch available
- High7.5Unauthenticated Arbitrary Post Deletion
WP DSGVO Tools (GDPR)
≤3.1.23Update to 3.1.24
- Medium4.8Stored Cross-Site Scripting
Request a Quote – Quote Forms for Any WordPress Site
<2.3.5Update to 2.3.5
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting
WP HTML Author Bio
≤1.2.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation
≤2.6.0Update to 2.6.1
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Sociable
≤4.3.4.1No patch available
- Medium4.8Authenticated Stored Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.1.3Update to 4.1.3.1
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
Polo Video Gallery – Best wordpress video gallery plugin
≤1.2No patch available
- Medium5.4Cross-Site Scripting
StreamCast – bring live radio to your site with a sleek player
<2.1.1Update to 2.1.1
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
微信打赏（Wechat Reward）
≤1.7No patch available
- Medium5.5Admin+ Stored Cross-Site Scripting
Tutor LMS – eLearning and online course solution
<1.9.9Update to 1.9.9
- Medium5.4Missing Authorization
Catch Themes Demo Import
<1.6Update to 1.6
- Medium6.4Cross-Site Scripting
Easy Feeds for X/Twitter – keep your site fresh with live social posts
<1.2Update to 1.2
- High8.8Cross-Site Request Forgery to Remote Code Execution and/or Cross-Site Scripting
Scroll Baner
≤1.0No patch available
- Medium5.4Stored Cross-Site Scripting
One User Avatar | User Profile Picture
<2.3.7Update to 2.3.7
- High7.2Admin+ SQL Injection
MainWP Child Reports
≤2.0.7Update to 2.0.8