CWE-269Vulnerability type

WordPress Privilege Escalation vulnerabilities (page 1348)

Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Privilege Escalation vulnerabilities (page 1348)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Cross-Site scripting Hot Files: File Sharing and Download Manager Plugin≤1.0.0No patch available	CVE-2014-4588	—	Aug 1, 2014
Critical9.8	Local/Remote File Inclusion SlideDeck 2 Lite Responsive Content Slider≤2.3.3Update to 2.3.5	CVE-2013-7483	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting custom-tables≤3.4.4No patch available	CVE-2012-20003	—	Aug 1, 2014
Critical9.8	Remote Code Execution WP Super Cache<1.3.2Update to 1.3.2	CVE-2013-2011	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Count per Day≤3.1.1Update to 3.2	CVE-2012-3434	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Tweet Blender≤4.0.1Update to 4.0.2	CVE-2013-6342	—	Aug 1, 2014
Medium5.3	Information Disclosure Portable phpMyAdmin≤1.4.1No patch available	CVE-2013-4454	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting WP Construction Mode≤1.8Update to 1.9	CVE-2014-4854	—	Aug 1, 2014
High7.1	Cross-Site Scripting Polylang<1.5.2Update to 1.5.2	CVE-2014-4855	—	Aug 1, 2014
Critical9.8	Arbitrary File Upload MailPoet Newsletters (Previous)≤2.6.6Update to 2.6.7	CVE-2014-4725	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery underConstruction<1.09Update to 1.09	CVE-2013-2699	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery Disable Comments<1.0.4Update to 1.0.4	CVE-2014-2550	—	Aug 1, 2014
Medium6.1	Multiple Cross-Site Scripting Uploader≤1.0.4No patch available	CVE-2013-2287	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery Stream Video Player≤1.4.1No patch available	CVE-2013-2706	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting bib2html≤0.9.3No patch available	CVE-2014-3870	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting Redirection<2.2.9Update to 2.2.9	CVE-2011-5329	—	Aug 1, 2014
Medium5.3	Full Path Disclosure WP PHP widget≤1.0.2No patch available	CVE-2013-0721	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting WP App Maker≤1.0.16.4No patch available	CVE-2014-4578	—	Aug 1, 2014
Medium6.4	Stored Cross-Site Scripting BuddyPress≤1.9.1Update to 1.9.2	CVE-2014-1888	—	Aug 1, 2014
Medium5.3	Cross-Site Scripting Redirection<2.2.10Update to 2.2.10	CVE-2011-4562	—	Aug 1, 2014
Medium6.1	Unauthenticated Stored Cross-Site Scripting Mail Subscribe List≤2.0.9Update to 2.1	CVE-2013-10026	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery sexybookmarks≤6.1.4.0Update to 6.1.5.0	CVE-2013-3256	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery to Cross-Site Scripting Contextual Related Posts≤1.8.6Update to 1.8.7	CVE-2013-2710	—	Aug 1, 2014
Medium6.1	Multiple Cross-Site Scripting Pie Register – User Registration, Profiles & Content Restriction≤1.30Update to 1.31	CVE-2013-4954	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Yoast Duplicate Post≤2.6Update to 3.0	CVE-2014-10378	—	Aug 1, 2014
Medium6.1	Multiple Cross-Site Scripting Events Manager – Calendar, Bookings, Tickets, Appointments and more!≤5.5.1Update to 5.5.2	CVE-2013-7477	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Album and Image Gallery with Lightbox – Flagallery Photo Portfolio≤2.71Update to 2.72	CVE-2013-3261	—	Aug 1, 2014
High7.5	Local File Inclusion WP AmASIN – The Amazon Affiliate Shop≤0.9.6Update to 0.9.7	CVE-2014-4577	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting DZS Video Gallery<7.95Update to 7.95	CVE-2014-3923	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting WP-Table Reloaded≤1.9.3Update to 1.9.4	CVE-2013-1463	—	Aug 1, 2014

Medium6.1
Cross-Site scripting
Hot Files: File Sharing and Download Manager Plugin
≤1.0.0No patch available
CVE-2014-4588Aug 1, 2014
Critical9.8
Local/Remote File Inclusion
SlideDeck 2 Lite Responsive Content Slider
≤2.3.3Update to 2.3.5
CVE-2013-7483Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
custom-tables
≤3.4.4No patch available
CVE-2012-20003Aug 1, 2014
Critical9.8
Remote Code Execution
WP Super Cache
<1.3.2Update to 1.3.2
CVE-2013-2011Aug 1, 2014
Medium6.1
Cross-Site Scripting
Count per Day
≤3.1.1Update to 3.2
CVE-2012-3434Aug 1, 2014
Medium6.1
Cross-Site Scripting
Tweet Blender
≤4.0.1Update to 4.0.2
CVE-2013-6342Aug 1, 2014
Medium5.3
Information Disclosure
Portable phpMyAdmin
≤1.4.1No patch available
CVE-2013-4454Aug 1, 2014
Medium6.1
Cross-Site Scripting
WP Construction Mode
≤1.8Update to 1.9
CVE-2014-4854Aug 1, 2014
High7.1
Cross-Site Scripting
Polylang
<1.5.2Update to 1.5.2
CVE-2014-4855Aug 1, 2014
Critical9.8
Arbitrary File Upload
MailPoet Newsletters (Previous)
≤2.6.6Update to 2.6.7
CVE-2014-4725Aug 1, 2014
High8.8
Cross-Site Request Forgery
underConstruction
<1.09Update to 1.09
CVE-2013-2699Aug 1, 2014
High8.8
Cross-Site Request Forgery
Disable Comments
<1.0.4Update to 1.0.4
CVE-2014-2550Aug 1, 2014
Medium6.1
Multiple Cross-Site Scripting
Uploader
≤1.0.4No patch available
CVE-2013-2287Aug 1, 2014
High8.8
Cross-Site Request Forgery
Stream Video Player
≤1.4.1No patch available
CVE-2013-2706Aug 1, 2014
Medium6.1
Cross-Site Scripting
bib2html
≤0.9.3No patch available
CVE-2014-3870Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
Redirection
<2.2.9Update to 2.2.9
CVE-2011-5329Aug 1, 2014
Medium5.3
Full Path Disclosure
WP PHP widget
≤1.0.2No patch available
CVE-2013-0721Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
WP App Maker
≤1.0.16.4No patch available
CVE-2014-4578Aug 1, 2014
Medium6.4
Stored Cross-Site Scripting
BuddyPress
≤1.9.1Update to 1.9.2
CVE-2014-1888Aug 1, 2014
Medium5.3
Cross-Site Scripting
Redirection
<2.2.10Update to 2.2.10
CVE-2011-4562Aug 1, 2014
Medium6.1
Unauthenticated Stored Cross-Site Scripting
Mail Subscribe List
≤2.0.9Update to 2.1
CVE-2013-10026Aug 1, 2014
High8.8
Cross-Site Request Forgery
sexybookmarks
≤6.1.4.0Update to 6.1.5.0
CVE-2013-3256Aug 1, 2014
High8.8
Cross-Site Request Forgery to Cross-Site Scripting
Contextual Related Posts
≤1.8.6Update to 1.8.7
CVE-2013-2710Aug 1, 2014
Medium6.1
Multiple Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction
≤1.30Update to 1.31
CVE-2013-4954Aug 1, 2014
Medium6.1
Cross-Site Scripting
Yoast Duplicate Post
≤2.6Update to 3.0
CVE-2014-10378Aug 1, 2014
Medium6.1
Multiple Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.5.1Update to 5.5.2
CVE-2013-7477Aug 1, 2014
Medium6.1
Cross-Site Scripting
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
≤2.71Update to 2.72
CVE-2013-3261Aug 1, 2014
High7.5
Local File Inclusion
WP AmASIN – The Amazon Affiliate Shop
≤0.9.6Update to 0.9.7
CVE-2014-4577Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
DZS Video Gallery
<7.95Update to 7.95
CVE-2014-3923Aug 1, 2014
Medium6.1
Cross-Site Scripting
WP-Table Reloaded
≤1.9.3Update to 1.9.4
CVE-2013-1463Aug 1, 2014