CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 1254)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Subscriber+ Arbitrary File Upload
SP Project & Document Manager
<4.24Update to 4.24
- Critical9.8Privilege Escalation
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium4.3Cross-Site Request Forgery leading to Settings Change
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium6.5Cross-Site Request Forgery
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium5.4Cross-Site Request Forgery
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium6.1Reflected Cross-Site Scripting
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- High8.8add sticky fixed buttons < 2.2.6 - SQL Injection
Side Menu Lite – Sticky Floating Side Menu
<2.2.6Update to 2.2.6
- High7.1Authenticated Insecure Direct Object References (IDOR)
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium6.1Reflected Cross-Site Scripting
Favicon by RealFaviconGenerator
<1.3.21Update to 1.3.21
- High8.8Cross-Site Request Forgery
Blue Admin
≤21.06.01No patch available
- High8.8Admin Custom Login <= 3.2.7 – Cross-Site Request Forgery to Stored Cross-Site Scripting
Admin Custom Login
≤3.2.7Update to 3.2.8
- High8.8Cross-Site Request Forgery
SEO Backlinks
≤4.0.1No patch available
- Critical9.9Authenticated WordPress Options Change
Advanced Shipment Tracking for WooCommerce
≤3.2.6Update to 3.2.7
- High8.8Post Index <= 0.7.5 Cross-Site Request Forgery to Stored Cross-Site Scripting
Post Index
≤0.7.5No patch available
- Medium4.8Authenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
<2.12.0Update to 2.12.0
- High8.8SQL Injection
Slider Hero with Video Background, Animation
<8.2.7Update to 8.2.7
- Medium6.1Poll Maker <= 3.2.8 – Reflected Cross-Site Scripting
Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls
≤3.2.8Update to 3.2.9
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
LukasApps CAPTCHA tools for Contact Form 7
<0.0.9Update to 0.0.9
- Critical9.8Unauthenticated SQL Injection
Directory Listings WordPress plugin – uListing
≤2.0.3Update to 2.0.4
- Medium5.4Contributor+ Stored Cross-Site Scripting
Simple Social Media Share Buttons – Social Sharing for Everyone
≤3.2.2Update to 3.2.3
- Medium5.5Authenticated Stored Cross-Site Scripting
WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS
<5.4.13Update to 5.4.13
- Medium5.4Authenticated Stored Cross-Site Scripting
WPFront Scroll Top
≤2.0.5Update to 2.0.6
- Medium6.4Cross-Site Scripting
Qyrr – simply and modern QR-Code creation
≤0.7Update to 0.8
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website
≤2.10.3Update to 2.10.4
- Medium5.4Stored Cross-Site Scripting
HD Quiz
<1.8.4Update to 1.8.4
- High7.2Authenticated SQL Injection
Simple Events Calendar
≤1.4.0Update to 1.4.1
- High7.2Authenticated (Admin+) SQL Injection
Broken Link Manager
≤0.6.5No patch available
- Medium5.4Reflected Cross-Site Scripting
Project Status
≤1.6No patch available
- High7.2Authenticated (Admin+) SQL Injection
M-vSlider
≤2.1.3No patch available
- Medium4.9Authenticated (Admin+) Arbitrary File Read
AceIDE
≤2.6.2No patch available