CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 1268)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.3Missing Authorization
Kaswara Modern VC Addons
≤3.0.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via title_size Parameter
Elementor Website Builder – more than just a page builder
<3.1.4Update to 3.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via title_size
Elementor Website Builder – more than just a page builder
0.1.0 – 3.1.3Update to 3.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via html_tag
Elementor Website Builder – more than just a page builder
0.1.0 – 3.1.3Update to 3.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via header_size
Elementor Website Builder – more than just a page builder
0.1.0 – 3.1.3Update to 3.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via title_html_tag
Elementor Website Builder – more than just a page builder
≤3.1.3Update to 3.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via html_tag
Elementor Website Builder – more than just a page builder
0.1.0 – 3.1.3Update to 3.1.4
- High8.8Privilege Escalation via REST API
BuddyPress
5.0.0 – 7.2.0Update to 7.2.1
- Medium6.1301 Redirect Manager <= 6.3 - Reflected Cross-Site Scripting
SEO Redirection Plugin – 301 Redirect Manager
≤6.3Update to 6.4
- Medium6.4Options Change to Stored Cross-Site Scripting
Flo Forms – Easy Drag & Drop Form Builder
≤1.0.35Update to 1.0.36
- Medium6.5Blind SQL Injection via start Parameter
wpDataTables (Premium)
<3.4.2Update to 3.4.2
- High8.1Improper Access Control leading to Table Data Deletion
wpDataTables (Premium)
<3.4.2Update to 3.4.2
- High7.2Authenticated (Admin+) Remote Code Execution
WP Super Cache
<1.7.2Update to 1.7.2
- Medium6.5Blind SQL Injection via length Parameter
wpDataTables (Premium)
<3.4.2Update to 3.4.2
- High8.1Improper Access Control leading to Table Permission Takeover
wpDataTables (Premium)
<3.4.2Update to 3.4.2
- Medium5.4Reflected Cross-Site Scripting
Related Posts for WordPress
≤2.0.3Update to 2.0.4
- Medium6.5SQL Injection via tutor_quiz_builder_get_question_form
Tutor LMS – eLearning and online course solution
≤1.8.2Update to 1.8.3
- Medium6.5SQL Injection
Tutor LMS – eLearning and online course solution
<1.7.7Update to 1.7.7
- Medium6.5SQL Injection
Tutor LMS – eLearning and online course solution
<1.7.7Update to 1.7.7
- High8.8SQL Injection via tutor_quiz_builder_get_answers_by_question
Tutor LMS – eLearning and online course solution
≤1.8.2Update to 1.8.3
- High8.8SQL Injection via tutor_answering_quiz_question/get_answer_by_id
Tutor LMS – eLearning and online course solution
<1.8.3Update to 1.8.3
- High8.8Unprotected AJAX including Privilege Escalation
Tutor LMS – eLearning and online course solution
<1.7.7Update to 1.7.7
- Medium6.1Reflected Cross-Site Scripting
Social Slider Feed – Social Media Feed & Gallery Widgets
<1.8.5Update to 1.8.5
- Medium4.3Cross-Site Request Forgery
VM Backups
≤1.0No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
VM Backups
≤1.0No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
JH 404 Logger
≤1.1No patch available
- High8.1Cross-Site Request Forgery
Database Backups
≤1.2.2.6No patch available
- Critical9.8Authentication Bypass
The Plus Addons for Elementor Page Builder Pro
<4.1.7Update to 4.1.7
- High7.5Unauthenticated Blind SQL Injection
Anti-Spam, Spam FireWall by CleanTalk
≤5.153.3Update to 5.153.4
- High8.8Authenticated SQL Injection
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
<2.5.6Update to 2.5.6