CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 1293)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-site Request Forgery
Attendance Manager
≤0.5.6Update to 0.5.7
- High8.8Cross-Site Request Forgery
Online Lesson Booking
≤0.8.6Update to 0.8.7
- Medium6.1Stored Cross-Site Scripting
Attendance Manager
≤0.5.6Update to 0.5.7
- Medium6.1Cross-Site Scripting
Breadcrumbs by menu
<1.0.3Update to 1.0.3
- High8.8Cross-Site Request Forgery
Breadcrumbs by menu
≤1.0.1Update to 1.0.3
- High7.5Unauthorized Account Creation
ConvertPlus
≤3.4.4Update to 3.4.5
- High8.8Arbitrary File Upload
Crelly Slider
≤1.3.4Update to 1.3.5
- High7.2Stored Cross-Site Scripting
Zoho SalesIQ – Live chat, chatbots, and visitor tracking
<1.0.9Update to 1.0.9
- Medium6.4Stored Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤12.6.5Update to 12.6.6.1
- High8.8Cross-Site Request Forgery
Zoho SalesIQ – Live chat, chatbots, and visitor tracking
<1.0.9Update to 1.0.9
- Critical9.8Unprotected Functions
3CX Free Live Chat, Calls & Messaging
<8.0.33Update to 8.0.33
- High8.8Cross-Site Request Forgery
Zoho SalesIQ – Live chat, chatbots, and visitor tracking
≤1.0.8Update to 1.0.9
- Medium6.1Cross-Site Scripting
Zoho SalesIQ – Live chat, chatbots, and visitor tracking
≤1.0.8Update to 1.0.9
- High8.8Privilege Escalation
Slick Popup: Contact Form 7 Popup Plugin
<1.7.2Update to 1.7.2
- Medium6.1Cross-Site Scripting
SAML Single Sign On – SSO Login
<4.8.73Update to 4.8.73
- High8.8Cross-Site Request Forgery
Affiliates Manager
<2.6.6Update to 2.6.6
- High7.2Stored Cross-Site Scripting
Hostel
≤1.1.3Update to 1.1.4
- High8.8Cross-site Request Forgery
Related YouTube Videos
<1.9.9Update to 1.9.9
- High7.8Unauthenticated CSV Injection
Hustle – Email Marketing, Lead Generation, Optins, Popups
≤6.0.7Update to 6.0.8.1
- High7.5Arbitrary File Download
Simple File List
≤3.2.7Update to 3.2.8
- Critical9.8Cross-Site Request Forgery
WP Booking System – Booking Calendar
<1.5.2Update to 1.5.2
- Medium6.1Unauthenticated Stored Cross-Site Scripting from Visitors
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
≤4.8Update to 4.8.1
- Critical9.8SQL Injection
FV Flowplayer Video Player
<7.3.15.727Update to 7.3.15.727
- Medium5.3Sensitive Information Exposure
FV Flowplayer Video Player
≤7.3.14.727Update to 7.3.15.727
- Medium6.1Unauthenticated Stored Cross-Site Scripting
FV Flowplayer Video Player
≤7.3.13.727Update to 7.3.14.727
- High8.1Object Injection Bypass
OptionTree
≤2.7.2Update to 2.7.3
- High8.1Object Injection Bypass
OptionTree
≤2.7.2Update to 2.7.3
- Medium5.4Cross-Site Scripting via show_products_page_limit parameter
Woocommerce Products Price Bulk Edit
≤2.0No patch available
- Medium4.8Cross-Site Scripting
Toggle The Title
≤1.4No patch available
- Medium4.9Authenticated Local File Inclusion
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.24Update to 1.5.25