CWE-269Vulnerability type

WordPress Privilege Escalation vulnerabilities (page 1328)

Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Privilege Escalation vulnerabilities (page 1328)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Reflected Cross-Site Scripting Manual Image Crop<1.11Update to 1.11	CVE-2015-9426	—	Aug 24, 2015
Medium6.1	Reflected Cross-Site Scripting GigPress≤2.3.10Update to 2.3.11	CVE-2015-9354	—	Aug 24, 2015
Medium4.7	Cross-Site Scripting Analyticator<6.4.9.6Update to 6.4.9.6	CVE-2015-6238	—	Aug 24, 2015
High7.2	SQL Injection GigPress<2.3.11Update to 2.3.11	CVE-2015-9353	—	Aug 24, 2015
Medium6.1	Cross-Site Request Forgery to Cross-Site Scripting Googmonify≤0.5.1No patch available	CVE-2015-9427	—	Aug 23, 2015
Critical9.8	Blind SQL Injection DukaPress≤2.5.9Update to 2.5.9.1	CVE-2015-1000011	—	Aug 22, 2015
High8.8	Cross-Site Request Forgery WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings<2.3.10Update to 2.3.10	CVE-2015-9307	—	Aug 21, 2015
Medium6.1	Reflected Cross-Site Scripting qTranslate X<3.4.4Update to 3.4.4	CVE-2015-9431	—	Aug 21, 2015
High8.8	Cross-Site Request Forgery WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings<2.3.10Update to 2.3.10	CVE-2015-9308	—	Aug 21, 2015
High8.8	Cross-Site Request Forgery WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings<2.3.10Update to 2.3.10	CVE-2015-9309	—	Aug 21, 2015
Medium5.4	Cross-Site Scripting Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages<1.1Update to 1.1	CVE-2015-9428	—	Aug 21, 2015
High7.2	Stored Cross-Site Scripting Crazy Bone<0.6.0Update to 0.6.0	CVE-2015-9430	—	Aug 21, 2015
Critical9.8	SQL Injection 404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring<2.0.3Update to 2.0.3	CVE-2015-9323	—	Aug 20, 2015
Medium6.1	Cross-Site Scripting Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin≤1.3.17Update to 1.3.18	CVE-2015-9304	—	Aug 20, 2015
Medium6.1	Cross-Site Scripting MDC Private Message≤1.0.1No patch available	CVE-2015-6805	—	Aug 20, 2015
Medium6.1	Reflected Cross-Site Scripting Alpine Photo Tile for Instagram<1.2.7.6Update to 1.2.7.6	CVE-2015-9432	—	Aug 20, 2015
Medium6.5	Cross-Site Scripting WP Social Bookmarking Light<1.7.10Update to 1.7.10	CVE-2015-9433	—	Aug 19, 2015
Medium6.1	Cross-Site Scripting WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export<3.8.1Update to 3.8.1	CVE-2015-9306	—	Aug 18, 2015
Medium6.1	Reflected Cross-Site Scripting WP Latest Posts≤3.7.4Update to 3.7.5	CVE-2016-10913	—	Aug 15, 2015
Critical9.1	Open Proxy google-adsense-and-hotel-booking≤1.05No patch available	CVE-2015-1000009	—	Aug 15, 2015
Medium6.1	Cross-Site Scripting All-In-One Security (AIOS) – Security and Firewall<3.9.8Update to 3.9.8	CVE-2015-9293	—	Aug 15, 2015
Critical9.8	Pseudorandom Number Generation WP OAuth Server (OAuth Authentication)<3.1.5Update to 3.1.5	CVE-2015-9435	—	Aug 12, 2015
Medium4.8	Authenticated Cross-Site Scripting WordPress Share Buttons Plugin – AddThis<5.0.13Update to 5.0.13	CVE-2015-9439	—	Aug 11, 2015
Medium5.4	Authenticated Cross-Site Scripting Display Widgets≤2.03Update to 2.04	CVE-2015-9438	—	Aug 11, 2015
Medium5.4	Cross-Site Scripting Dynamic Widgets<1.5.11Update to 1.5.11	CVE-2015-9436	—	Aug 11, 2015
Medium6.1	Refletced Cross-Site Scripting Dynamic Widgets<1.5.11Update to 1.5.11	CVE-2015-9437	—	Aug 11, 2015
Medium6.4	Stored Cross-Site Scripting iframe≤4.0Update to 4.1	CVE-2015-6738	—	Aug 10, 2015
Critical9.8	Code Injection Events Manager – Calendar, Bookings, Tickets, Appointments and more!<5.6Update to 5.6	CVE-2015-9298	—	Aug 10, 2015
Medium6.1	Cross-Site Scripting Events Manager – Calendar, Bookings, Tickets, Appointments and more!<5.6Update to 5.6	CVE-2015-9297	—	Aug 10, 2015
Medium5.4	Cross-Site Request Forgery to Cross-Site Scripting bookmarkify≤1.1.3No patch available	CVE-2015-9441	—	Aug 9, 2015

Medium6.1
Reflected Cross-Site Scripting
Manual Image Crop
<1.11Update to 1.11
CVE-2015-9426Aug 24, 2015
Medium6.1
Reflected Cross-Site Scripting
GigPress
≤2.3.10Update to 2.3.11
CVE-2015-9354Aug 24, 2015
Medium4.7
Cross-Site Scripting
Analyticator
<6.4.9.6Update to 6.4.9.6
CVE-2015-6238Aug 24, 2015
High7.2
SQL Injection
GigPress
<2.3.11Update to 2.3.11
CVE-2015-9353Aug 24, 2015
Medium6.1
Cross-Site Request Forgery to Cross-Site Scripting
Googmonify
≤0.5.1No patch available
CVE-2015-9427Aug 23, 2015
Critical9.8
Blind SQL Injection
DukaPress
≤2.5.9Update to 2.5.9.1
CVE-2015-1000011Aug 22, 2015
High8.8
Cross-Site Request Forgery
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
<2.3.10Update to 2.3.10
CVE-2015-9307Aug 21, 2015
Medium6.1
Reflected Cross-Site Scripting
qTranslate X
<3.4.4Update to 3.4.4
CVE-2015-9431Aug 21, 2015
High8.8
Cross-Site Request Forgery
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
<2.3.10Update to 2.3.10
CVE-2015-9308Aug 21, 2015
High8.8
Cross-Site Request Forgery
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
<2.3.10Update to 2.3.10
CVE-2015-9309Aug 21, 2015
Medium5.4
Cross-Site Scripting
Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages
<1.1Update to 1.1
CVE-2015-9428Aug 21, 2015
High7.2
Stored Cross-Site Scripting
Crazy Bone
<0.6.0Update to 0.6.0
CVE-2015-9430Aug 21, 2015
Critical9.8
SQL Injection
404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring
<2.0.3Update to 2.0.3
CVE-2015-9323Aug 20, 2015
Medium6.1
Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤1.3.17Update to 1.3.18
CVE-2015-9304Aug 20, 2015
Medium6.1
Cross-Site Scripting
MDC Private Message
≤1.0.1No patch available
CVE-2015-6805Aug 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Alpine Photo Tile for Instagram
<1.2.7.6Update to 1.2.7.6
CVE-2015-9432Aug 20, 2015
Medium6.5
Cross-Site Scripting
WP Social Bookmarking Light
<1.7.10Update to 1.7.10
CVE-2015-9433Aug 19, 2015
Medium6.1
Cross-Site Scripting
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
<3.8.1Update to 3.8.1
CVE-2015-9306Aug 18, 2015
Medium6.1
Reflected Cross-Site Scripting
WP Latest Posts
≤3.7.4Update to 3.7.5
CVE-2016-10913Aug 15, 2015
Critical9.1
Open Proxy
google-adsense-and-hotel-booking
≤1.05No patch available
CVE-2015-1000009Aug 15, 2015
Medium6.1
Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
<3.9.8Update to 3.9.8
CVE-2015-9293Aug 15, 2015
Critical9.8
Pseudorandom Number Generation
WP OAuth Server (OAuth Authentication)
<3.1.5Update to 3.1.5
CVE-2015-9435Aug 12, 2015
Medium4.8
Authenticated Cross-Site Scripting
WordPress Share Buttons Plugin – AddThis
<5.0.13Update to 5.0.13
CVE-2015-9439Aug 11, 2015
Medium5.4
Authenticated Cross-Site Scripting
Display Widgets
≤2.03Update to 2.04
CVE-2015-9438Aug 11, 2015
Medium5.4
Cross-Site Scripting
Dynamic Widgets
<1.5.11Update to 1.5.11
CVE-2015-9436Aug 11, 2015
Medium6.1
Refletced Cross-Site Scripting
Dynamic Widgets
<1.5.11Update to 1.5.11
CVE-2015-9437Aug 11, 2015
Medium6.4
Stored Cross-Site Scripting
iframe
≤4.0Update to 4.1
CVE-2015-6738Aug 10, 2015
Critical9.8
Code Injection
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.6Update to 5.6
CVE-2015-9298Aug 10, 2015
Medium6.1
Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.6Update to 5.6
CVE-2015-9297Aug 10, 2015
Medium5.4
Cross-Site Request Forgery to Cross-Site Scripting
bookmarkify
≤1.1.3No patch available
CVE-2015-9441Aug 9, 2015