CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 1280)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Request Forgery leading to Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.24.2Update to 3.4.24.2
- High8.8SQL Injection
WordPress WP-Advanced-Search
≤3.3.6Update to 3.3.7
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Real-Time Find and Replace
≤3.9Update to 4.0.2
- Medium6.4Authenticated (Contributor+) Cross-Site Scripting
Avada | Website Builder For WordPress & WooCommerce
<6.2.3Update to 6.2.3
- High7.3Missing Authorization Checks
WP GDPR
≤2.1.1No patch available
- Medium5.3Information Disclosure
Advanced Woo Search – Product Search for WooCommerce
≤1.99Update to 2.00
- Medium6.1Unauthenticated Stored Cross-Site Scripting
WP GDPR
≤2.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Catch Breadcrumb
<1.5.5Update to 1.5.5
- High7.3Missing Authorization
Timetable and Event Schedule by MotoPress
≤2.3.8Update to 2.3.9
- Medium6.4Authenticated Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.9.7Update to 2.9.8
- High8.1Privilege Escalation via accept-to-be-teacher action parameter
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.2.6.8Update to 3.2.6.9
- Medium6.1Reflected Cross Site Scripting
Translate WordPress with GTranslate
≤2.8.51Update to 2.8.52
- High7.1Authenticated Page Creation and Status Modification
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.2.6.8Update to 3.2.6.9
- High7.4Unauthorized Widget Import to Stored Cross-Site Scripting
Widget Settings Importer/Exporter
≤1.5.3No patch available
- Critical9.8Missing Authorization
TS Poll – Survey, Versus Poll, Image Poll, Video Poll
<1.3.4Update to 1.3.4
- Medium6.1Cross-Site Scripting
Advanced Order Export For WooCommerce
<3.1.4Update to 3.1.4
- High8.3Cross-Site Request Forgery
WordPress Landing Page – Squeeze Page – Responsive Landing Page Builder Free – WP Lead Plus X
≤0.99No patch available
- Medium5.4Authenticated Stored Cross-Site Scripting
WordPress Landing Page – Squeeze Page – Responsive Landing Page Builder Free – WP Lead Plus X
<0.99Update to 0.99
- High7.2Stored Cross-Site Scripting
WordPress Landing Page – Squeeze Page – Responsive Landing Page Builder Free – WP Lead Plus X
≤0.98Update to 0.99
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Car Rental System
≤1.3No patch available
- Medium6.1Marketplace Digital Products PHP7 <= 2.1 - Cross-Site Scripting
Vanguard - Marketplace Digital Products PHP7
≤2.1No patch available
- High7.2Cross-Site Scripting
Online Hotel Booking System Pro
≤1.1No patch available
- Critical9.8Unauthenticated Settings Update
OneTone Companion
≤1.1.1No patch available
- High7.2Stored Cross-Site Scripting
OneTone Companion
≤1.1.1No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting
Contact Form 7 Datepicker
≤2.6.0No patch available
- High7.2Stored Cross-Site Scripting
Login by Auth0
≤3.11.3Update to 4.0.0
- Medium6.5Authenticated Map Creation/Deletion to Stored Cross-Site Scripting & Remote Code Execution
MapPress – Free Map Plugin for Google Maps & OpenStreetMap
<2.53.9Update to 2.53.9
- High8.8Cross-Site Request Forgery
Login by Auth0
≤3.11.3Update to 4.0.0
- Critical9.8Unauthenticated SQL Injection
LearnDash LMS
≤3.1.5Update to 3.1.6
- Medium4.3Insecure Direct Object Reference
Login by Auth0
≤3.11.3Update to 4.0.0