CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 1296)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Multiple Cross-Site Request Forgery vulnerabilities
LoginWP (Formerly Peter's Login Redirect)
≤2.9.1Update to 2.9.2
- Medium6.1Stored Cross-Site Scripting
WooCommerce
<3.5.5Update to 3.5.5
- High8.8Remote Code Execution
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.5Path Traversal and Local File Inclusion
WordPress
≤5.0.2Update to 5.0.3
- Medium6.4Stored Cross-Site Scripting
Launcher: Coming Soon & Maintenance Mode
<1.0.11Update to 1.0.11
- Medium6.5Authenticated Denial of Service
PS PHPCaptcha WP
≤1.1.0Update to 1.2.0
- Critical9.8Missing Authorization to Arbitrary File Upload/Delete
WP Cost Estimation & Payment Forms Builder
<9.644Update to 9.644
- Medium6.5Upload Directory Traversal
WP Cost Estimation & Payment Forms Builder
<9.660Update to 9.660
- Medium6.5SQL Injection
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.6Update to 1.6
- Medium6.1Cross-Site Scripting
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.6Update to 1.6
- Medium6.1Reflected Cross-Site Scripting
NextScripts: Social Networks Auto-Poster
<4.2.8Update to 4.2.8
- Medium6.1Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
<8.0.18Update to 8.0.18
- Medium6.1Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
<2.3.1Update to 2.3.1
- Medium6.1Reflected Cross-Site Scripting
Contact Form Email
<1.2.66Update to 1.2.66
- Medium6.1Reflected Cross-Site Scripting
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
≤2.8Update to 2.8.1
- Medium6.1Reflected Cross-Site Scripting
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
≤7.10.41Update to 7.10.43
- Medium6.1Reflected Cross-Site Scripting via poll_id Parameter
YOP Poll
<6.0.3Update to 6.0.3
- High7.2Stored Cross-Site Scripting
WP Support Plus Responsive Ticket System
<9.1.2Update to 9.1.2
- Medium6.1Stored Cross-Site Scripting
WP Support Plus Responsive Ticket System
<9.1.2Update to 9.1.2
- Medium6.1Cross-Site Scripting
Parallax Scroll by adamrob.co.uk
<2.1Update to 2.1
- High8.1WordPress Custom Fields Framework <= 4.16.2 - File Deletion via attachment_id Parameter
Meta Box – A Framework for Dynamic Websites
<4.16.3Update to 4.16.3
- High7.5Mishandling of File Upload
Meta Box – A Framework for Dynamic Websites
≤4.16.1Update to 4.16.2
- Medium6.1Reverse Tabnabbing
Wise Chat
<2.7Update to 2.7
- Critical9.8Missing Authorization to Arbitrary Options Update
Total Donations
≤2.0.5Update to 3.0.0
- Critical9.8Social Media API Key Leakage <= 1.7.1 - Information Exposure
Social Network Tabs
≤1.7.1No patch available
- Critical9.8Local File Inclusion
Shortcode Factory
≤2.7Update to 2.8
- Medium6.1Cross-Site Scripting
Easy Redirect Manager
≤2.18.18No patch available
- Medium6.1Unauthenticated Cross-Site Scripting
spam-byebye
≤2.2.1Update to 2.2.2
- Medium6.1Stored Cross-Site Scripting
Gallery Images Ape
≤1.6.14Update to 2.0.0
- High8.8Cross-Site Request Forgery and Local File Inclusion
Companion Sitemap Generator – Simple, Smart, and SEO-Ready
≤3.6.6Update to 3.7.0