CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 20)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.3Unauthenticated Privilege Escalation
WHIZZ
≤1.1.8No patch available
- Medium4.3Missing Authorization
AZEXO Store Locator
≤1.4No patch available
- Medium6.42.5.4 - Authenticated (Author+) Stored Cross-Site Scripting
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
2.5.0 – 2.5.4Update to 2.5.5
- Medium5.3Missing Authorization
Dynific Addons for Elementor (formerly Anywhere Elementor)
≤1.3.0Update to 1.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Dynific Addons for Elementor (formerly Anywhere Elementor)
≤1.3.0Update to 1.3.1
- Medium4.3Authenticated (Contributor+) Information Exposure
Dynific Addons for Elementor (formerly Anywhere Elementor)
≤1.3.0Update to 1.3.1
- High7.3Unauthenticated Privilege Escalation
placester
≤1.4.3No patch available
- Critical9.8Unauthenticated Administrator Account Takeover
Wurdey
≤1.0.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
MCB – Stats
≤1.0.0No patch available
- Medium6.4Cross-Site Request Forgery to Stored Cross-Site Scripting
WP PageNavi Style
≤1.4No patch available
- Medium4.3Missing Authorization
CatFolders – WordPress Media Library Folders & Categories
≤2.5.6Update to 2.5.7
- Medium5.3Unauthenticated Email Spoofing
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.3.2Update to 5.3.3
- Medium5.3Missing Authorization
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.3.2Update to 5.3.3
- Medium5.3Missing Authorization
DT LMS – elearning, WordPress LMS Plugin
≤1.2No patch available
- Medium5.3Unauthenticated Information Exposure
Car Dealer (Dealership) and Vehicle sales
≤4.73No patch available
- High7.2Unauthenticated Server-Side Request Forgery
Gallery for Social Photo
≤1.0.0.41Update to 1.0.0.43
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Easy Social Icons
≤4.0.2Update to 4.0.3
- Low2.7Authenticated (Editor+) Information Exposure
weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce
<2.1.7Update to 2.1.7
- Low2.7Missing Authorization
weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce
<2.1.7Update to 2.1.7
- Medium5.3Unauthenticated Information Exposure
WATI Chat and Notification
≤1.1.8No patch available
- Medium4.3Missing Authorization
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤4.0.2Update to 4.0.3
- High7.5Unauthenticated SQL Injection
IVPAY payments
≤1.0.8No patch available
- High7.31.0.16 - Unauthenticated Privilege Escalation
Security For WooCommerce
1.0.10 – 1.0.16No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Cloud Blocks
≤1.1.8No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Easy Social Icons
≤4.0.2Update to 4.0.3
- Medium5.9Unauthenticated Sensitive Information Exposure via Cached wp-activate.php Response
WP Fastest Cache – WordPress Cache Plugin
≤1.5.3Update to 1.5.4
- Critical9.8Unauthenticated Remote Code Execution via 'item_name' IPN Parameter
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
≤260927Update to 261001
- Critical9.8Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field
Ultra Addons for Contact Form 7
≤3.5.54Update to 3.5.55
- Medium6.5Authenticated (Subscriber+) SQL Injection
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
<5.1.0Update to 5.1.0
- Medium5.3Missing Authorization
Essential Real Estate
≤5.3.4Update to 5.3.5