CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 25)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
Independent Analytics Pro
≤2.15.5Update to 2.16.0
- High7.5Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.3.1Update to 1.58.0
- High7.5Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter
Email Templates Customizer and Designer for WordPress and WooCommerce
≤1.5.14Update to 1.5.15
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parameter
CP Multi View Events Calendar
≤1.4.43Update to 1.4.44
- High7.2Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter
easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution
≤2.8.4Update to 2.8.5
- High7.2Unauthenticated Stored Cross-Site Scripting via Inbound Email Body
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
≤1.17.10Update to 1.17.11
- Medium4.3Cross-Site Request Forgery
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce
≤4.7.5Update to 4.7.6
- Medium4.3Cross-Site Request Forgery
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.8.8Update to 3.8.9
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.19Update to 2.8.20
- High8.1Unauthenticated Arbitrary File Upload via Avada Form Upload Field
Avada | Website Builder For WordPress & WooCommerce
≤7.16.2Update to 7.16.4
- Medium6.5Unauthenticated Shortcode Injection via 'pagination_info' Parameter
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.198Update to 2.8.199
- Medium4.3Missing Authorization
Event Tickets and Registration
≤5.30.2Update to 5.30.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Media Player Addons for Elementor – Audio and Video Widgets for Elementor
≤1.1.10Update to 1.1.11
- Medium4.3Missing Authorization
The Events Calendar
≤6.18.2Update to 6.18.3
- Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' Parameter
JS Help Desk – AI-Powered Support & Ticketing System
≤5.0.1Update to 5.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Iptanus File Upload
≤5.2.1Update to 5.2.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name
Photo Engine (Media Organizer & Lightroom)
≤6.5.7Update to 6.5.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title()
SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress
≤0.9.9Update to 1.0.0
- Medium6.5Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint
Meow Gallery
≤5.5.4Update to 5.5.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field
Themify Builder
≤7.8.4Update to 7.8.5
- High8.1Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.7.2Update to 3.7.3
- Medium4.3Missing Authorization
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution
≤3.2.6Update to 3.3.0
- High7.5Unauthenticated SQL Injection
Bookit — Booking & Appointment Calendar
≤2.6.0.6Update to 2.6.0.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Events Calendar
≤6.18.2Update to 6.18.3
- Medium4.3Missing Authorization
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar
≤6.5.4Update to 6.5.5
- Medium5.3Missing Authorization
The Events Calendar
≤6.18.2Update to 6.18.3
- High8.1Unauthenticated Account Takeover
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.5Update to 4.9.6
- Medium5.3Missing Authorization
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.7.1Update to 3.6.8
- High7.4Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤6.8.7Update to 6.8.8
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure via PATCH /files/placements/<id> on orphaned placements
OpenStation – Admin Dashboard Notes, Custom Dashboard, AI Assistant & PWA
≤1.1.16Update to 1.1.17