CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 1266)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Rife Extensions & Templates for Elementor
<1.1.6Update to 1.1.6
- High7.5Directory Traversal
Video Downloader for TikTok
<1.4Update to 1.4
- High8.6Directory Traversal
Media File Organizer
≤1.0.1No patch available
- Critical9.1Server-Side Request Forgery
Import XML and RSS Feeds
<2.0.3Update to 2.0.3
- High8.8Cross-Site Request Forgery to Arbitrary Listing Export
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.11.1Update to 5.11.2
- Medium4.3Cross-Site Request Forgery to Arbitrary Payment History Update
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.11.1Update to 5.11.2
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
WP Super Cache
<1.7.3Update to 1.7.3
- Medium6.5Cross-Site Request Forgery to Stored Cross-Site Scripting
Content Copy Protection & Prevent Image Save
≤1.3No patch available
- Medium5.4Authenticated Stored Cross-Site Scripting
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.11.1Update to 5.11.2
- High8.8Cross-Site Request Forgery
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.11Update to 5.11.1
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.10.1Update to 5.11
- High7.2Authenticated PHP4 Upload
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.11Update to 5.11.1
- High7.2Arbitrary File Upload
College publisher Import
≤0.1No patch available
- High8.8Arbitrary File Upload
classyfrieds
≤3.8No patch available
- High7.2Cross-Site Request Forgery
Event Banner
≤1.3No patch available
- Medium6.4Authenticated (Subscriber+) Cross-Site Scripting
Contact Form Check Tester
≤1.0.2No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting
Larsens Calender
≤1.2No patch available
- High8.8Cross-Site Request Forgery
Media File Renamer: Rename Images & Files for SEO (AI-Powered)
≤5.2.5Update to 5.2.6
- High7.4Multiple Stored Cross-Site scripting
WP Page Builder
<1.2.4Update to 1.2.4
- Medium5.4Insecure Default to Unauthorized Page Editing
WP Page Builder
<1.2.4Update to 1.2.4
- Critical9.8Arbitrary File Upload
Imagements
≤1.2.5No patch available
- Medium6.1Reflected Cross-Site Scripting
Stop Spammers Classic
<2021.9Update to 2021.9
- Medium6.4Job Board WordPress Theme <= 2.0.31 - Stored Cross-Site Scripting
Workscout Core
<1.3.4Update to 1.3.4
- Medium6.1Reflected Cross-Site Scripting
OpenID Connect Generic Client
3.8.0 – <3.8.2Update to 3.8.2
- Medium6.5Arbitrary License Options Update
WPBakery Page Builder Clipboard
<4.5.8Update to 4.5.8
- Medium5.5Authenticated Local File Inclusion
Tutor LMS – eLearning and online course solution
≤1.8.7Update to 1.8.8
- Medium6.1Reflected Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction
<3.7.0.1Update to 3.7.0.1
- Medium6.4Stored Cross-Site Scripting
WPBakery Page Builder Clipboard
<4.5.6Update to 4.5.6
- Critical9.8Arbitrary File Upload
Business Hours Pro WordPress Plugin
≤5.5.0No patch available
- Medium4.8Authenticated Stored Cross-Site Scripting
Erident Custom Login Page & Dashboard
≤3.5.8Update to 3.5.9