CWE-269Vulnerability type

WordPress Privilege Escalation vulnerabilities (page 1362)

Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Privilege Escalation vulnerabilities (page 1362)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Cross-Site Scripting Events Manager – Calendar, Bookings, Tickets, Appointments and more!<5.1.7Update to 5.1.7	CVE-2012-6716	—	May 22, 2012
High7.2	Cross-Site Scripting Share and Follow≤1.80.3Update to 1.80.4	CVE-2012-2917	—	May 21, 2012
Medium6.1	Cross-Site Scripting AJAX Auth – Fast Logins, 2FA, Redirects≤3.0.4Update to 3.0.4.1	CVE-2012-2759	—	May 18, 2012
High7.1	Cross-Site Scripting WP Forum Server<1.7.5Update to 1.7.5	CVE-2012-6623	—	May 15, 2012
Medium6.1	Cross-Site Scripting Sharebar≤1.2.1Update to 1.2.2	CVE-2012-6718	—	May 15, 2012
Medium6.1	Multiple Cross-Site Scripting LeagueManager≤3.7Update to 3.8	CVE-2012-2912	—	May 15, 2012
Medium6.1	Authenticated (Admin+) Stored Cross-Site Scripting WP Forum Server≤1.7.3Update to 1.7.4	CVE-2012-6622	—	May 15, 2012
Critical9.8	SQL Injection Sharebar<1.2.2Update to 1.2.2	CVE-2012-6719	—	May 15, 2012
High7.2	SQL Injection WP Forum Server<1.7.4Update to 1.7.4	CVE-2012-6625	—	May 15, 2012
Medium6.1	Cross-Site Scripting Sabre<1.2.2Update to 1.2.2	CVE-2012-2916	—	May 15, 2012
Medium6.1	Cross-Site Scripting Newsletter Manager<1.0.2Update to 1.0.2	CVE-2012-6628	—	May 15, 2012
Medium6.1	Cross-Site Scripting Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)≤2.3Update to 2.3.1	CVE-2012-2913	—	May 15, 2012
Medium6.1	Cross-Site Scripting via test_mail.php Newsletter Manager<1.0.2Update to 1.0.2	CVE-2012-6627	—	May 15, 2012
Medium6.1	Cross-Site Scripting SoundCloud Is Gold≤2.2Update to 2.2.1	CVE-2012-6624	—	May 15, 2012
Medium6.1	Cross-Site Scripting WP-FaceThumb≤0.1Update to 0.2	CVE-2012-2371	—	May 13, 2012
Medium6.1	Cross-Site Scripting 2 Click Social Media Buttons<0.34Update to 0.34	CVE-2012-4273	—	May 11, 2012
Medium6.1	Reflected Cross-Site Scripting BulletProof Security<.47.1Update to .47.1	CVE-2012-4268	—	May 11, 2012
High7.2	Cross-Site Scripting Kadence Security – Password, Two Factor Authentication, and Brute Force Protection<3.2.5Update to 3.2.5	CVE-2012-4263	—	May 11, 2012
Medium6.1	Multiple Cross-Site Scripting 2 Click Social Media Buttons≤0.33Update to 0.34	CVE-2012-4272	—	May 11, 2012
Medium6.1	Multiple Cross-Site Scripting Kadence Security – Password, Two Factor Authentication, and Brute Force Protection≤3.2.4Update to 3.2.5	CVE-2012-4264	—	May 11, 2012
Medium6.1	2.2.4 - Cross-Site Scripting Bad Behavior<2.2.5Update to 2.0.47 or 2.2.5	CVE-2012-4271	—	May 11, 2012
Medium6.1	Cross-Site Scripting User Photo≤0.9.5Update to 0.9.5.2	CVE-2012-2920	—	May 9, 2012
Medium6.1	Cross-Site Scripting AJAX Auth – Fast Logins, 2FA, Redirects<3.0.4.1Update to 3.0.5	CVE-2012-4283	—	May 7, 2012
Medium6.1	Reflected Cross-Site Scripting Redirection<2.2.12Update to 2.2.12	CVE-2012-6717	—	May 4, 2012
Medium6.1	Cross-Site Scripting zingiri-web-shop<2.4.2Update to 2.4.2	CVE-2012-6506	—	Apr 26, 2012
Medium5.3	Sensitive Information Disclosure ShareYourCart<1.7.1Update to 1.7.1	CVE-2012-4332	—	Apr 24, 2012
Medium6.1	Multiple Cross-Site Scripting Organizer≤1.2.1No patch available	CVE-2012-6511	—	Apr 23, 2012
Medium5.4	Cross-Site Scripting WordPress≤3.3.1Update to 3.3.2	CVE-2012-2404	—	Apr 21, 2012
High7.2	Cross-Site Scripting WordPress≤3.5.1Update to 3.5.2	CVE-2012-2399	—	Apr 21, 2012
Medium5.4	Authorization Bypass WordPress≤3.3.1Update to 3.3.2	CVE-2012-2402	—	Apr 20, 2012

Medium6.1
Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.1.7Update to 5.1.7
CVE-2012-6716May 22, 2012
High7.2
Cross-Site Scripting
Share and Follow
≤1.80.3Update to 1.80.4
CVE-2012-2917May 21, 2012
Medium6.1
Cross-Site Scripting
AJAX Auth – Fast Logins, 2FA, Redirects
≤3.0.4Update to 3.0.4.1
CVE-2012-2759May 18, 2012
High7.1
Cross-Site Scripting
WP Forum Server
<1.7.5Update to 1.7.5
CVE-2012-6623May 15, 2012
Medium6.1
Cross-Site Scripting
Sharebar
≤1.2.1Update to 1.2.2
CVE-2012-6718May 15, 2012
Medium6.1
Multiple Cross-Site Scripting
LeagueManager
≤3.7Update to 3.8
CVE-2012-2912May 15, 2012
Medium6.1
Authenticated (Admin+) Stored Cross-Site Scripting
WP Forum Server
≤1.7.3Update to 1.7.4
CVE-2012-6622May 15, 2012
Critical9.8
SQL Injection
Sharebar
<1.2.2Update to 1.2.2
CVE-2012-6719May 15, 2012
High7.2
SQL Injection
WP Forum Server
<1.7.4Update to 1.7.4
CVE-2012-6625May 15, 2012
Medium6.1
Cross-Site Scripting
Sabre
<1.2.2Update to 1.2.2
CVE-2012-2916May 15, 2012
Medium6.1
Cross-Site Scripting
Newsletter Manager
<1.0.2Update to 1.0.2
CVE-2012-6628May 15, 2012
Medium6.1
Cross-Site Scripting
Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)
≤2.3Update to 2.3.1
CVE-2012-2913May 15, 2012
Medium6.1
Cross-Site Scripting via test_mail.php
Newsletter Manager
<1.0.2Update to 1.0.2
CVE-2012-6627May 15, 2012
Medium6.1
Cross-Site Scripting
SoundCloud Is Gold
≤2.2Update to 2.2.1
CVE-2012-6624May 15, 2012
Medium6.1
Cross-Site Scripting
WP-FaceThumb
≤0.1Update to 0.2
CVE-2012-2371May 13, 2012
Medium6.1
Cross-Site Scripting
2 Click Social Media Buttons
<0.34Update to 0.34
CVE-2012-4273May 11, 2012
Medium6.1
Reflected Cross-Site Scripting
BulletProof Security
<.47.1Update to .47.1
CVE-2012-4268May 11, 2012
High7.2
Cross-Site Scripting
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
<3.2.5Update to 3.2.5
CVE-2012-4263May 11, 2012
Medium6.1
Multiple Cross-Site Scripting
2 Click Social Media Buttons
≤0.33Update to 0.34
CVE-2012-4272May 11, 2012
Medium6.1
Multiple Cross-Site Scripting
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
≤3.2.4Update to 3.2.5
CVE-2012-4264May 11, 2012
Medium6.1
2.2.4 - Cross-Site Scripting
Bad Behavior
<2.2.5Update to 2.0.47 or 2.2.5
CVE-2012-4271May 11, 2012
Medium6.1
Cross-Site Scripting
User Photo
≤0.9.5Update to 0.9.5.2
CVE-2012-2920May 9, 2012
Medium6.1
Cross-Site Scripting
AJAX Auth – Fast Logins, 2FA, Redirects
<3.0.4.1Update to 3.0.5
CVE-2012-4283May 7, 2012
Medium6.1
Reflected Cross-Site Scripting
Redirection
<2.2.12Update to 2.2.12
CVE-2012-6717May 4, 2012
Medium6.1
Cross-Site Scripting
zingiri-web-shop
<2.4.2Update to 2.4.2
CVE-2012-6506Apr 26, 2012
Medium5.3
Sensitive Information Disclosure
ShareYourCart
<1.7.1Update to 1.7.1
CVE-2012-4332Apr 24, 2012
Medium6.1
Multiple Cross-Site Scripting
Organizer
≤1.2.1No patch available
CVE-2012-6511Apr 23, 2012
Medium5.4
Cross-Site Scripting
WordPress
≤3.3.1Update to 3.3.2
CVE-2012-2404Apr 21, 2012
High7.2
Cross-Site Scripting
WordPress
≤3.5.1Update to 3.5.2
CVE-2012-2399Apr 21, 2012
Medium5.4
Authorization Bypass
WordPress
≤3.3.1Update to 3.3.2
CVE-2012-2402Apr 20, 2012