CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 1265)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.8Authenticated Stored Cross-Site Scripting
SEO Redirection Plugin – 301 Redirect Manager
≤6.4Update to 7.1
- Medium6.1Reflected Cross-Site Scripting
404 SEO Redirection
≤1.3Update to 1.4
- Medium6.4Stored Cross-Site Scripting
Clever Addons for Elementor
<2.1.0Update to 2.1.0
- High7.1XXE Injection
WordPress
<5.7.1Update to 4.7.20 or 4.8.16 or 4.9.17 or 5.0.12 or 5.1.9 or 5.2.10 or 5.3.7 or 5.4.5 or 5.5.4 or 5.6.3 or 5.7.1
- Medium6.5Sensitive Information Disclosure
WordPress
<5.7.1Update to 4.7.20 or 4.8.16 or 4.9.17 or 5.0.12 or 5.1.9 or 5.2.10 or 5.3.7 or 5.4.5 or 5.5.4 or 5.6.3 or 5.7.1
- High8.8Authenticated (Contributor+) Privilege Escalation
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤2.0.6Update to 2.0.7
- Medium6.5Authenticated (Contributor+) Arbitrary File Read
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤4.1.9Update to 2.0.7 or 4.1.10
- Medium5.4Cross-Site Request Forgery to Stored Cross-Site Scripting
fitness calculators
≤1.9.5Update to 1.9.6
- High8.3Server-Side Request Forgery
Video Downloader for TikTok
<1.4Update to 1.4
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤2.1.7Update to 2.2.0
- Medium6.5Server-Side Request Forgery
Podcast Importer SecondLine
<1.1.5Update to 1.1.5
- Medium5.4Authenticated Stored Cross-Site Scripting
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
<2.0.6Update to 2.0.6
- Medium5.4Contributor+ Stored Cross-Site Scripting
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤2.3.1Update to 2.3.2
- Medium5.4Authenticated Stored Cross-Site Scripting
DethemeKit for Elementor
<1.5.5.5Update to 1.5.5.5
- Medium5.4Stored Cross-Site Scripting
Addon Elements for Elementor (formerly Elementor Addon Elements)
<1.11.2Update to 1.11.2
- Medium5.4Stored Cross-Site Scripting
Ultimate Addons for Elementor
<1.30.0Update to 1.30.0
- Medium5.3Server-Side Request Forgery
WP-DownloadManager
<1.68.5Update to 1.68.5
- Medium5.4Absolute Addons for Elementor Page Builder <= 1.5.5 - Contributor+ Stored Cross-Site Scripting
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
≤1.5.5Update to 1.5.7
- Medium6.1Cross-Site Scripting
CM Download Manager – Organize, Protect & Share Files in WordPress
<2.8.0Update to 2.8.0
- Medium5.4Livemesh Addons for Elementor <= 6.7.1- Contributor+ Stored Cross-Site Scripting
Livemesh Addons by Elementor
≤6.7.1Update to 6.8
- Medium6.4WidgetKit <= 2.3.9 - Contributor+ Stored Cross-Site Scripting
WidgetKit for Elementor – Lightweight Elementor Addons, Widgets & Templates
<2.3.10Update to 2.3.10
- Medium6.4Stored Cross-Site Scripting
Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder
<1.5.8Update to 1.5.8
- High8.1Directory Traversal to Arbitrary File Deletion and Denial of Service
CM Download Manager – Organize, Protect & Share Files in WordPress
<2.8.0Update to 2.8.0
- Medium5.4Stored Cross-Site Scripting
Sina Extension for Elementor
<3.3.12Update to 3.3.12
- Medium5.4Cross-Site Scripting
Essential Addons for Elementor – Popular Elementor Templates & Widgets
<4.5.4Update to 4.5.4
- Critical9.1Server-Side Request Forgery
Import XML and RSS Feeds
<2.0.3Update to 2.0.3
- Medium6.4Authenticated Stored Cross-Site Scripting
Image Hover Effects – Elementor Addon
<1.3.4Update to 1.3.4
- High8.6Directory Traversal
Media File Organizer
≤1.0.1No patch available
- High7.5Directory Traversal
Video Downloader for TikTok
<1.4Update to 1.4
- Medium6.4Authenticated Stored Cross-Site Scripting
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
<1.8.6Update to 1.8.6