CWE-269Vulnerability type

WordPress Privilege Escalation vulnerabilities (page 1351)

Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Privilege Escalation vulnerabilities (page 1351)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Reflected Cross-Site Scripting Ruven Toolkit≤2.0No patch available	CVE-2014-4548	—	Jun 12, 2014
Medium6.1	Reflected Cross-Site Scripting WordPress Responsive Preview<1.2Update to 1.2	CVE-2014-4594	—	Jun 12, 2014
Medium6.1	Cross-Site Scripting Appointments Scheduler≤1.5No patch available	CVE-2014-4579	—	Jun 12, 2014
Medium6.1	Cross-Site Scripting Webcam/Screen/Mic Recorder for Video Comments and Forms≤1.55Update to 1.55.3	CVE-2014-4567	—	Jun 12, 2014
Medium6.1	Reflected Cross-Site Scripting Webcam Microphone Screen Recorder – Media Capture≤1.55.4Update to 1.55.5	CVE-2014-4568	—	Jun 12, 2014
Medium6.1	Reflected Cross-Site Scripting VideoWhisper Video Presentation≤3.25Update to 3.31	CVE-2014-4570	—	Jun 12, 2014
Medium6.1	Cross-Site Scripting wp-football≤1.1No patch available	CVE-2014-4586	—	Jun 12, 2014
High7.1	Cross-Site Scripting wp-tmkm-amazon<1.5.3Update to 1.5.3	CVE-2014-4598	—	Jun 12, 2014
High7.1	Cross-Site Scripting WP Microblogs≤0.4.0No patch available	CVE-2014-4590	—	Jun 12, 2014
Medium6.1	Cross-Site Scripting Member Approval≤131109No patch available	CVE-2014-3850	—	Jun 10, 2014
Medium4.3	Cross-Site Request Forgery leading to player deletion JW Player for Flash & HTML5 Video<2.1.4Update to 2.1.4	CVE-2014-4030	—	Jun 10, 2014
High8.8	Cross-Site Request Forgery Featured Comments<1.2.5Update to 1.2.5	CVE-2014-4163	—	Jun 10, 2014
Medium6.1	Reflected Cross-Site Scripting Disqus Comment System<2.76Update to 2.76	CVE-2014-5345	—	Jun 9, 2014
Critical9.8	SQL Injection Participants Database<1.5.4.9Update to 1.5.4.9	CVE-2014-3961	—	Jun 2, 2014
High7.2	Cross-Site Scripting simple-popup-images≤1.0Update to 1.1	CVE-2014-3921	—	May 30, 2014
High7.5	Path Traversal Cross-RSS≤1.7No patch available	CVE-2014-4941	—	May 29, 2014
Medium6.1	Cross-Site Scripting Jigoshop Swipe plugin≤3.1.0No patch available	CVE-2014-4557	—	May 28, 2014
High7.1	Cross-Site Scripting Malware Finder≤1.1No patch available	CVE-2014-4538	—	May 28, 2014
Medium6.1	Cross-Site Scripting Validated≤1.0.2Update to 2.0.0	CVE-2014-4564	—	May 28, 2014
Medium6.1	Cross-Site Scripting your-text-manager≤0.3.0No patch available	CVE-2014-4604	—	May 28, 2014
Critical9.8	SQL Injection WP Rss Poster≤1.0.0No patch available	CVE-2014-4938	—	May 28, 2014
Medium6.1	Cross-Site Scripting wppm≤1.6.4.bNo patch available	CVE-2014-4593	—	May 28, 2014
Medium6.1	Reflected Cross-Site Scripting Conversador≤2.61No patch available	CVE-2014-4519	—	May 28, 2014
High7.1	Cross-Site Scripting Oleggo LiveStream≤0.2.6No patch available	CVE-2014-4540	—	May 28, 2014
Medium6.1	Reflected Cross-Site Scripting ActiveHelper LiveHelp Live Chat<3.1.5Update to 3.1.5	CVE-2014-4513	—	May 28, 2014
Medium6.1	Reflected Cross-Site Scripting swipehq-payment-gateway-woocommerce≤2.7.1No patch available	CVE-2014-4558	—	May 28, 2014
Medium6.1	Cross-Site Scripting Rezgo Online Booking<1.4.3Update to 1.4.3	CVE-2014-4546	—	May 28, 2014
Medium6.1	Cross-Site Scripting BIC Media Widget≤1.0No patch available	CVE-2014-4516	—	May 28, 2014
High8.8	Authenticated SQL Injection YAWPP (Yet Another WordPress Petition Plugin)≤1.2.1Update to 1.2.2	CVE-2014-5182	—	May 28, 2014
High7.2	Authenticated (Admin+) SQL Injection ENL Newsletter≤1.0.1No patch available	CVE-2014-4939	—	May 28, 2014

Medium6.1
Reflected Cross-Site Scripting
Ruven Toolkit
≤2.0No patch available
CVE-2014-4548Jun 12, 2014
Medium6.1
Reflected Cross-Site Scripting
WordPress Responsive Preview
<1.2Update to 1.2
CVE-2014-4594Jun 12, 2014
Medium6.1
Cross-Site Scripting
Appointments Scheduler
≤1.5No patch available
CVE-2014-4579Jun 12, 2014
Medium6.1
Cross-Site Scripting
Webcam/Screen/Mic Recorder for Video Comments and Forms
≤1.55Update to 1.55.3
CVE-2014-4567Jun 12, 2014
Medium6.1
Reflected Cross-Site Scripting
Webcam Microphone Screen Recorder – Media Capture
≤1.55.4Update to 1.55.5
CVE-2014-4568Jun 12, 2014
Medium6.1
Reflected Cross-Site Scripting
VideoWhisper Video Presentation
≤3.25Update to 3.31
CVE-2014-4570Jun 12, 2014
Medium6.1
Cross-Site Scripting
wp-football
≤1.1No patch available
CVE-2014-4586Jun 12, 2014
High7.1
Cross-Site Scripting
wp-tmkm-amazon
<1.5.3Update to 1.5.3
CVE-2014-4598Jun 12, 2014
High7.1
Cross-Site Scripting
WP Microblogs
≤0.4.0No patch available
CVE-2014-4590Jun 12, 2014
Medium6.1
Cross-Site Scripting
Member Approval
≤131109No patch available
CVE-2014-3850Jun 10, 2014
Medium4.3
Cross-Site Request Forgery leading to player deletion
JW Player for Flash & HTML5 Video
<2.1.4Update to 2.1.4
CVE-2014-4030Jun 10, 2014
High8.8
Cross-Site Request Forgery
Featured Comments
<1.2.5Update to 1.2.5
CVE-2014-4163Jun 10, 2014
Medium6.1
Reflected Cross-Site Scripting
Disqus Comment System
<2.76Update to 2.76
CVE-2014-5345Jun 9, 2014
Critical9.8
SQL Injection
Participants Database
<1.5.4.9Update to 1.5.4.9
CVE-2014-3961Jun 2, 2014
High7.2
Cross-Site Scripting
simple-popup-images
≤1.0Update to 1.1
CVE-2014-3921May 30, 2014
High7.5
Path Traversal
Cross-RSS
≤1.7No patch available
CVE-2014-4941May 29, 2014
Medium6.1
Cross-Site Scripting
Jigoshop Swipe plugin
≤3.1.0No patch available
CVE-2014-4557May 28, 2014
High7.1
Cross-Site Scripting
Malware Finder
≤1.1No patch available
CVE-2014-4538May 28, 2014
Medium6.1
Cross-Site Scripting
Validated
≤1.0.2Update to 2.0.0
CVE-2014-4564May 28, 2014
Medium6.1
Cross-Site Scripting
your-text-manager
≤0.3.0No patch available
CVE-2014-4604May 28, 2014
Critical9.8
SQL Injection
WP Rss Poster
≤1.0.0No patch available
CVE-2014-4938May 28, 2014
Medium6.1
Cross-Site Scripting
wppm
≤1.6.4.bNo patch available
CVE-2014-4593May 28, 2014
Medium6.1
Reflected Cross-Site Scripting
Conversador
≤2.61No patch available
CVE-2014-4519May 28, 2014
High7.1
Cross-Site Scripting
Oleggo LiveStream
≤0.2.6No patch available
CVE-2014-4540May 28, 2014
Medium6.1
Reflected Cross-Site Scripting
ActiveHelper LiveHelp Live Chat
<3.1.5Update to 3.1.5
CVE-2014-4513May 28, 2014
Medium6.1
Reflected Cross-Site Scripting
swipehq-payment-gateway-woocommerce
≤2.7.1No patch available
CVE-2014-4558May 28, 2014
Medium6.1
Cross-Site Scripting
Rezgo Online Booking
<1.4.3Update to 1.4.3
CVE-2014-4546May 28, 2014
Medium6.1
Cross-Site Scripting
BIC Media Widget
≤1.0No patch available
CVE-2014-4516May 28, 2014
High8.8
Authenticated SQL Injection
YAWPP (Yet Another WordPress Petition Plugin)
≤1.2.1Update to 1.2.2
CVE-2014-5182May 28, 2014
High7.2
Authenticated (Admin+) SQL Injection
ENL Newsletter
≤1.0.1No patch available
CVE-2014-4939May 28, 2014