CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 1369)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.2 | Arbitrary File Upload | CVE-2008-2392 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2008-2068 | — | |
| High7.5 | Directory Traversal | CVE-2008-4769 | — | |
| High8.1 | Authentication Bypass | CVE-2008-1930 | — | |
| Critical9.8 | Unauthenticated SQL Injection | CVE-2008-1982 | — | |
| Critical9.8 | SQL Injection | CVE-2008-1646 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2008-1061 | — | |
| Critical9.8 | Remote Code Execution | CVE-2008-1060 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2008-1059 | — | |
| Critical9.8 | SQL Injection | CVE-2008-0939 | — | |
| Critical9.8 | SQL Injection | CVE-2008-0845 | — | |
| Critical9.8 | SQL Injection | CVE-2008-7040 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2008-0837 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2008-1304 | — | |
| Critical9.8 | SQL Injection | CVE-2008-0683 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2008-0618 | — | |
| Medium5.3 | Directory Traversal | CVE-2008-0615 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2008-0617 | — | |
| Critical9.8 | SQL Injection | CVE-2008-0682 | — | |
| High7.2 | SQL Injection | CVE-2008-0616 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2008-0691 | — | |
| Critical9.8 | 1.4.3 - SQL Injection | CVE-2008-0520 | — | |
| Critical9.1 | SQL injection | CVE-2008-0491 | — | |
| Critical9.8 | SQL Injection | CVE-2008-0507 | — | |
| Critical9.8 | SQL Injection | CVE-2008-0490 | — | |
| Medium6.1 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2008-0508 | — | |
| Critical9.8 | Remote SQL Injection | CVE-2008-0388 | — | |
| High7.5 | CAPTCHA Bypass | CVE-2008-7216 | — | |
| High7.3 | Authorization Bypass | CVE-2008-4616 | — | |
| Medium6.1 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2008-0197 | — |
- High7.2Arbitrary File Upload
WordPress
≤2.5.1Update to 2.5.2
- Medium6.4Cross-Site Scripting
WordPress
≤2.5Update to 2.5.1
- High7.5Directory Traversal
WordPress
≤2.5Update to 2.5.1
- High8.1Authentication Bypass
WordPress
≤2.5Update to 2.5.1
- Critical9.8Unauthenticated SQL Injection
WordPress Spreadsheet
≤0.6No patch available
- Critical9.8SQL Injection
WP-Download
≤1.2Update to 1.2.1
- Medium6.1Cross-Site Scripting
Sniplets
<1.2.3Update to 1.2.3
- Critical9.8Remote Code Execution
Sniplets
<1.2.3Update to 1.2.3
- Critical9.8Remote File Inclusion
Sniplets
<1.2.3Update to 1.2.3
- Critical9.8SQL Injection
WP Photo Album Plus
≤1.0Update to 1.1
- Critical9.8SQL Injection
WP People
≤3.4.1No patch available
- Critical9.8SQL Injection
Yellow Swordfish Simple Forum
≤1.11No patch available
- Medium6.1Cross-Site Scripting
Search Unleashed
≤0.2.10Update to 0.2.11
- Medium6.4Cross-Site Scripting
WordPress
≤2.3.2Update to 2.3.3
- Critical9.8SQL Injection
ShiftThis
all versionsNo patch available
- Medium6.1Cross-Site Scripting
DMSGuestbook
<1.9.0Update to 1.9.0
- Medium5.3Directory Traversal
DMSGuestbook
≤1.8.0Update to 1.8.1
- Medium6.1Cross-Site Scripting
DMSGuestbook
<1.9.0Update to 1.9.0
- Critical9.8SQL Injection
WordSpew
≤3.71No patch available
- High7.2SQL Injection
DMSGuestbook
all versionsNo patch available
- Medium6.1Multiple Cross-Site Scripting
WP-Footnotes
≤2.2Update to 3.0
- Critical9.81.4.3 - SQL Injection
WassUp Real Time Analytics
1.4 – 1.4.3Update to 1.4.4
- Critical9.1SQL injection
fgallery
≤2.4.1Update to 2.4.2
- Critical9.8SQL Injection
AdServe
≤0.2Update to 0.3
- Critical9.8SQL Injection
wp-cal
≤0.3No patch available
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Dean's Permalinks Migration
≤1.0No patch available
- Critical9.8Remote SQL Injection
wp-forum
≤1.7.4Update to 1.7.7
- High7.5CAPTCHA Bypass
Peter's Math Anti-Spam
≤0.1.6Update to 1.0.0
- High7.3Authorization Bypass
SpamBam
≤2.1No patch available
- Medium6.1Authenticated (Admin+) Stored Cross-Site Scripting
WP-ContactForm
≤1.5No patch available