CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 1359)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | Authentication Bypass | CVE-2013-2743 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2013-2640 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-0731 | — | |
| High7.2 | SQL Injection | CVE-2013-1852 | — | |
| Medium6.1 | Cross-Site Scripting via playerID | CVE-2013-2714 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2013-2501 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-7472 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2013-7480 | — | |
| Critical9.8 | SQL Injection | CVE-2013-0735 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2013-0734 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-1765 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-1759 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-1758 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-1808 | — | |
| High7.5 | 1.9.11 - Full Path Disclosure | CVE-2013-0291 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2013-0286 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2013-10023 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-1409 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2013-0724 | — | |
| High7.2 | Multiple SQL Injections | CVE-2013-1408 | — | |
| Critical9.8 | Unauthenticated Remote File Inclusion | CVE-2012-4919 | — | |
| Medium6.1 | Cross-Site Scripting via playerID Parameter | CVE-2013-1464 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2013-0236 | — | |
| Medium5.4 | Server-Side Request Forgery | CVE-2013-0235 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2013-0237 | — | |
| Critical9.8 | SQL Injection | CVE-2013-1401 | — | |
| Critical9.8 | SQL Injection | CVE-2013-1400 | — | |
| High7.5 | Directory Traversal | CVE-2012-4920 | — | |
| High7.5 | Directory Traversal | CVE-2012-4915 | — | |
| Low3.8 | Remote Code Execution via Remote File Inclusion | CVE-2012-10025 | — |
- Critical9.8Authentication Bypass
BackupBuddy
<3.0Update to 3.0
- Medium6.4Cross-Site Scripting
MailUp newsletter sign-up form
<1.3.2Update to 1.3.2
- Medium6.1Cross-Site Scripting
MailUp newsletter sign-up form
<1.3.3Update to 1.3.3
- High7.2SQL Injection
LeagueManager
<3.8.1Update to 3.8.1
- Medium6.1Cross-Site Scripting via playerID
podpress
≤8.8.10.17No patch available
- Medium6.4Stored Cross-Site Scripting
Terillion Reviews
<1.2Update to 1.2
- Medium6.1Cross-Site Scripting
Count per Day
<3.2.6Update to 3.2.6
- Medium6.1Multiple Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.3.6Update to 5.3.6.1
- Critical9.8SQL Injection
Mingle Forum
≤1.0.33.3Update to 1.0.34
- High7.2Stored Cross-Site Scripting
Mingle Forum
≤1.0.33.3Update to 1.0.34
- Medium6.1Cross-Site Scripting
Smart Flv
≤1.0No patch available
- Medium6.1Cross-Site Scripting
Responsive Logo Slideshow
<1.2Update to 1.2
- Medium6.1Cross-Site Scripting
Marekkis Watermark-Plugin
≤0.9.4No patch available
- Medium6.1Cross-Site Scripting
Zendesk Chat
<1.2.6Update to 1.2.6
- High7.51.9.11 - Full Path Disclosure
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
1.9.10 – 1.9.11Update to 2.0.0
- Medium5.4Cross-Site Scripting
Pinboard
≤1.1.11Update to 1.1.12
- High7.2Authenticated (Admin+) SQL Injection
Editorial Calendar
≤2.6Update to 2.7
- Medium6.1Reflected Cross-Site Scripting
CommentLuv
<2.92.4Update to 2.92.4
- Critical9.8Remote File Inclusion
WP eCommerce Shop Styling
<1.8Update to 1.8
- High7.2Multiple SQL Injections
MailPoet Newsletters (Previous)
≤2.2Update to 2.2.1
- Critical9.8Unauthenticated Remote File Inclusion
WordPress Gallery Plugin
≤1.4No patch available
- Medium6.1Cross-Site Scripting via playerID Parameter
audio-player
<2.0.4.6Update to 2.0.4.6
- Medium6.4Stored Cross-Site Scripting
WordPress
<3.5.1Update to 3.5.1
- Medium5.4Server-Side Request Forgery
WordPress
≤3.5Update to 3.5.1
- Medium6.4Cross-Site Scripting
WordPress
≤3.5Update to 3.5.1
- Critical9.8SQL Injection
WordPress Poll
≤34.05Update to 34.06
- Critical9.8SQL Injection
WordPress Poll
≤34.05Update to 34.06
- High7.5Directory Traversal
Forums
<1.4.4Update to 1.4.4
- High7.5Directory Traversal
Google Doc Embedder
<2.5.4Update to 2.5.4
- Low3.8Remote Code Execution via Remote File Inclusion
Advanced Custom Fields (ACF®)
≤3.5.1Update to 3.5.2