CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 1349)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Remote Code Execution
WP Super Cache
≤1.2Update to 1.3
- High8.1Unauthenticated Local File Inclusion
Tinymce Thumbnail Gallery
≤1.0.0Update to 1.1.0
- Medium4.3Cross-Site Request Forgery
Calendar
≤1.3.2Update to 1.3.3
- Medium4.7Cross-Site Request Forgery
Simple Shopping Cart
<3.6Update to 3.6
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.3.9Update to 5.3.9
- Medium5.3Reflected Cross-Site Scripting
Verification Code for Comments
≤2.1.0No patch available
- High8.8SQL Injection
Mingle Forum
≤1.0.32.1Update to 1.0.33
- Medium6.1Cross-Site Scripting
WP Symposium
≤11.11.26Update to 11.12.08
- Medium4.3Cross-Site Request Forgery
WordPress Related Posts
<2.7.2Update to 2.7.2
- Critical9.8SQL Injection
Yoast Duplicate Post
≤2.5Update to 2.6
- High7.3Unspecified Vulnerability
Image News Slider
≤3.2Update to 3.3
- Medium6.1Cross-Site Scripting
XEN Carousel
≤0.12.2No patch available
- High8.8Cross-Site Request Forgery
WP Activity Log
<1.2.5Update to 1.2.5
- Medium6.1DOM Cross-Site Scripting
Image Slider
<1.1.7Update to 1.1.7
- Medium6.1Unauthenticated Multiple Cross-Site Scripting
Media Library Categories
≤1.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Platinum SEO
≤1.3.7Update to 1.3.8
- Critical9.8Remote File Inclusion
WP-Table
≤1.43Update to 1.44
- Medium6.3Cross-Site Request Forgery
Cart66 Lite :: WordPress Ecommerce
<1.5.1.15Update to 1.5.1.15
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Dropdown Menu Widget
≤1.9.7No patch available
- Critical9.8Unrestricted File Upload
gravity-file-ajax-upload-free
≤1.1No patch available
- Medium6.1Cross-Site Scripting
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤0.4.4Update to 0.4.5
- Medium6.1Multiple Cross-Site Scripting
WP Super Cache
≤1.3Update to 1.3.1
- Critical9.8Arbitrary File Upload
WordPress Font Uploader
≤1.3Update to 1.3.1
- High7.1Cross-Site Scripting
WP Symposium
<13.04Update to 13.04
- High7.2Cross-Site Scripting
Wordfence Security – Firewall, Malware Scan, and Login Security
≤5.1.3Update to 5.1.4
- High8.8Cross-Site Request Forgery
WhyDoWork AdSense
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
WhyDoWork AdSense
≤1.2No patch available
- Critical9.8SQL Injection
fbgorilla
all versionsNo patch available
- Critical9.8SQL Injection
Lead-Octopus-Power
<1.1.1Update to 1.1.1
- Medium5.3Information Disclosure
WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps
<2.0.2Update to 2.0.2