CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 1278)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter | CVE-2020-13640 | — | |
| Medium5.3 | Comment Disclosure WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-25286 | — | |
| Low3.5 | Arbitrary User Meta Update WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-4050 | — | |
| Low2.4 | Self-Cross Site Scripting via Theme Folder Name WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-4049 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2020-36172 | — | |
| Medium6.8 | Authenticated Stored Cross-Site Scripting WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-4047 | — | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-4046 | — | |
| Medium5.7 | Open Redirect WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-4048 | — | |
| High7.2 | Admin+ SQL Injection | CVE-2020-35012 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2020-13892 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2020-35037 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2020-13865 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2020-13864 | — | |
| Critical9.8 | Contact Form 7 <= 1.3.3.2 - Arbitrary File Upload | CVE-2020-12800 | — | |
| High7.2 | Authenticated SQL Injection | CVE-2021-24138 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2022-1169 | — | |
| High7.1 | Reflected Cross-Site Scripting | CVE-2022-1168 | — | |
| High7.4 | Authorization Bypass to Settings Updates | CVE-2020-36714 | — | |
| Medium4.8 | Cross-Site Scripting | CVE-2019-20182 | — | |
| High7.2 | Authenticated (Admin+) Arbitrary File Upload | CVE-2022-1939 | — | |
| High7.3 | Authenticated CSV Injection | CVE-2020-36503 | — | |
| High7.5 | Insecure direct object reference via permalinks manipulation | CVE-2020-13700 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2021-24137 | — | |
| Critical9.8 | Unauthenticated Privilege Escalation | CVE-2020-13693 | — | |
| High8.8 | Remote Code Execution via Improper Capability Checks in AJAX Calls | CVE-2020-12675 | — | |
| High8.8 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2020-35944 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2020-14962 | — | |
| Medium4.8 | Authenticated (Admin+) Stored Cross-Site Scripting via the forums list table | CVE-2020-13487 | — | |
| High7.4 | Missing Authorization to Cross-Site Scripting | CVE-2020-35947 | — | |
| Medium5.4 | Stored Cross-Site Scripting ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin≤3.9.2Update to 3.9.3 | CVE-2021-24127 | — |
- Critical9.8wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter
Comments – wpDiscuz
<5.3.6Update to 5.3.6
- Medium5.3Comment Disclosure
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Low3.5Arbitrary User Meta Update
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Low2.4Self-Cross Site Scripting via Theme Folder Name
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Medium6.1Cross-Site Scripting
Advanced Custom Fields (ACF®)
<5.8.12Update to 5.8.12
- Medium6.8Authenticated Stored Cross-Site Scripting
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Medium5.4Authenticated Stored Cross-Site Scripting
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Medium5.7Open Redirect
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- High7.2Admin+ SQL Injection
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.9.7.3Update to 5.9.8
- Medium5.4Cross-Site Scripting
SportsPress – Sports Club & League Manager
<2.7.2Update to 2.7.2
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.9.7.3Update to 5.9.8
- Medium5.4Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.9.8Update to 2.9.9
- Medium5.4Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.9.8Update to 2.9.9
- Critical9.8Contact Form 7 <= 1.3.3.2 - Arbitrary File Upload
Drag and Drop Multiple File Upload for Contact Form 7
≤1.3.3.2Update to 1.3.3.3
- High7.2Authenticated SQL Injection
AdRotate Banner Manager
<5.8.4Update to 5.8.4
- Medium6.1Cross-Site Scripting
Careerfy - Job Board WordPress Theme
<3.9.0Update to 3.9.0
- High7.1Reflected Cross-Site Scripting
JobSearch WP Job Board
<1.5.1Update to 1.5.1
- High7.4Authorization Bypass to Settings Updates
Brizy – Page Builder
<1.0.126Update to 1.0.126
- Medium4.8Cross-Site Scripting
FooGallery Photo Gallery : Image, Video & Masonry Galleries
≤1.8.12Update to 1.8.18
- High7.2Authenticated (Admin+) Arbitrary File Upload
Allow svg files
<1.1Update to 1.1
- High7.3Authenticated CSV Injection
Connections Business Directory
≤9.6Update to 9.7
- High7.5Insecure direct object reference via permalinks manipulation
ACF to REST API
≤3.2.0Update to 3.3.0
- High8.8Authenticated SQL Injection
Blog2Social: Social Media Auto Post & Scheduler
≤6.3.0Update to 6.3.1
- Critical9.8Unauthenticated Privilege Escalation
bbPress
≤2.6.4Update to 2.6.5
- High8.8Remote Code Execution via Improper Capability Checks in AJAX Calls
MapPress – Free Map Plugin for Google Maps & OpenStreetMap
≤2.54.5Update to 2.54.6
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Page Builder: Pagelayer – Drag and Drop website builder
<1.1.2Update to 1.1.2
- Medium6.4Authenticated Stored Cross-Site Scripting
Image Photo Gallery Final Tiles Grid
≤3.4.18Update to 3.4.19
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting via the forums list table
bbPress
≤2.6.4Update to 2.6.5
- High7.4Missing Authorization to Cross-Site Scripting
Page Builder: Pagelayer – Drag and Drop website builder
<1.1.2Update to 1.1.2
- Medium5.4Stored Cross-Site Scripting
ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
≤3.9.2Update to 3.9.3