CWE-269Vulnerability type

WordPress Privilege Escalation vulnerabilities (page 29)

Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Privilege Escalation vulnerabilities (page 29)
Severity	Vulnerability	CVE	Installs	Published
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting JetElements≤2.9.2.6Update to 2.9.2.7	CVE-2026-39737	—	Oct 29
Medium5.3	Missing Authorization Flexible Quantity & Price Calculator for WooCommerce≤2.3.24Update to 2.3.25	CVE-2026-116856	—	Oct 29
Medium5.3	Missing Authorization SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz≤2.12.9Update to 2.13.0	CVE-2026-116387	—	Oct 29
Medium5.3	Missing Authorization WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell≤3.13.5Update to 3.13.6	CVE-2026-118091	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Kadence Blocks — Page Builder Toolkit for Gutenberg Editor≤3.8.0.2Update to 3.8.1	CVE-2026-39742	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors≤4.17.0Update to 4.18.0	CVE-2026-115610	—	Oct 29
Medium4.3	Missing Authorization MasterStudy LMS WordPress Plugin – for Online Courses and Education≤3.7.55Update to 3.7.56	CVE-2026-118092	—	Oct 29
Medium4.3	Missing Authorization Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar≤6.5.4Update to 6.5.5	CVE-2026-116406	—	Oct 29
Medium4.3	Missing Authorization User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission≤4.3.13Update to 4.3.14	CVE-2026-52708	—	Oct 29
Medium5.3	Missing Authorization WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory≤2.9.26Update to 2.10.0	CVE-2026-116846	—	Oct 29
Medium5.3	Missing Authorization User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission≤4.3.13Update to 4.3.14	CVE-2026-48884	—	Oct 29
Medium6.5	Authenticated (Contributor+) SQL Injection JetEngine≤3.9.0.1Update to 3.9.0.2	CVE-2026-39736	—	Oct 29
Medium5.3	Missing Authorization Kali Forms — Contact Form & Drag-and-Drop Builder≤2.4.27Update to 2.4.28	CVE-2026-39782	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting JetSmartFilters≤3.8.6.2Update to 3.8.6.3	CVE-2026-116857	—	Oct 29
Medium4.3	Cross-Site Request Forgery InstaWP Connect – 1-click WP Staging & Migration≤0.1.4.2Update to 0.1.4.3	CVE-2026-116399	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Import and export users and customers≤2.5.9Update to 2.5.10	CVE-2026-54862	—	Oct 29
Medium4.3	Missing Authorization HivePress Claim Listings≤1.1.4Update to 1.1.5	CVE-2026-42707	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting PDF Poster – Let visitors read PDF’s without leaving the page≤2.6.1Update to 2.6.2	CVE-2026-48195	—	Oct 29
Medium5.3	Missing Authorization Simple CAPTCHA with Cloudflare Turnstile≤1.44.0Update to 1.44.1	CVE-2026-39741	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Kali Forms — Contact Form & Drag-and-Drop Builder≤2.4.27Update to 2.4.28	CVE-2026-48196	—	Oct 29
Medium4.3	Missing Authorization WP Job Portal – AI-Powered Recruitment System for Company or Job Board website≤2.7.1Update to 2.7.2	CVE-2026-22386	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Video Gallery Block – showcase your videos in a filterable gallery≤1.6.0Update to 1.7.0	CVE-2026-52709	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Cozy Blocks – Website Builder & Business Growth Toolkit \| Popups, Lead Forms & Inbox≤2.2.27Update to 2.2.28	CVE-2026-24533	—	Oct 29
Medium4.3	Missing Authorization Kali Forms — Contact Form & Drag-and-Drop Builder≤2.4.27Update to 2.4.28	CVE-2026-42703	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Site Reviews≤8.3.5Update to 8.3.6	CVE-2026-118087	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting Ad Inserter – Ad Manager & AdSense Ads≤2.8.18Update to 2.8.19	CVE-2026-118094	—	Oct 29
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid≤7.9.7Update to 7.9.8	CVE-2026-56056	—	Oct 29
Medium4.3	Missing Authorization JetEngine≤3.9.0.1Update to 3.9.0.2	CVE-2026-39735	—	Oct 29
Medium5.3	Missing Authorization Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels≤7.14.1Update to 7.14.2	CVE-2026-118093	—	Oct 29
Medium5.3	Missing Authorization YITH PayPal Express Checkout for WooCommerce≤1.62.0Update to 1.62.1	CVE-2026-27401	—	Oct 29

Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
≤2.9.2.6Update to 2.9.2.7
CVE-2026-39737Oct 29
Medium5.3
Missing Authorization
Flexible Quantity & Price Calculator for WooCommerce
≤2.3.24Update to 2.3.25
CVE-2026-116856Oct 29
Medium5.3
Missing Authorization
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.12.9Update to 2.13.0
CVE-2026-116387Oct 29
Medium5.3
Missing Authorization
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.13.5Update to 3.13.6
CVE-2026-118091Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.8.0.2Update to 3.8.1
CVE-2026-39742Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
≤4.17.0Update to 4.18.0
CVE-2026-115610Oct 29
Medium4.3
Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.55Update to 3.7.56
CVE-2026-118092Oct 29
Medium4.3
Missing Authorization
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar
≤6.5.4Update to 6.5.5
CVE-2026-116406Oct 29
Medium4.3
Missing Authorization
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.13Update to 4.3.14
CVE-2026-52708Oct 29
Medium5.3
Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.26Update to 2.10.0
CVE-2026-116846Oct 29
Medium5.3
Missing Authorization
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.13Update to 4.3.14
CVE-2026-48884Oct 29
Medium6.5
Authenticated (Contributor+) SQL Injection
JetEngine
≤3.9.0.1Update to 3.9.0.2
CVE-2026-39736Oct 29
Medium5.3
Missing Authorization
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.27Update to 2.4.28
CVE-2026-39782Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
JetSmartFilters
≤3.8.6.2Update to 3.8.6.3
CVE-2026-116857Oct 29
Medium4.3
Cross-Site Request Forgery
InstaWP Connect – 1-click WP Staging & Migration
≤0.1.4.2Update to 0.1.4.3
CVE-2026-116399Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Import and export users and customers
≤2.5.9Update to 2.5.10
CVE-2026-54862Oct 29
Medium4.3
Missing Authorization
HivePress Claim Listings
≤1.1.4Update to 1.1.5
CVE-2026-42707Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
PDF Poster – Let visitors read PDF’s without leaving the page
≤2.6.1Update to 2.6.2
CVE-2026-48195Oct 29
Medium5.3
Missing Authorization
Simple CAPTCHA with Cloudflare Turnstile
≤1.44.0Update to 1.44.1
CVE-2026-39741Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.27Update to 2.4.28
CVE-2026-48196Oct 29
Medium4.3
Missing Authorization
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.7.1Update to 2.7.2
CVE-2026-22386Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Video Gallery Block – showcase your videos in a filterable gallery
≤1.6.0Update to 1.7.0
CVE-2026-52709Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
≤2.2.27Update to 2.2.28
CVE-2026-24533Oct 29
Medium4.3
Missing Authorization
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.27Update to 2.4.28
CVE-2026-42703Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Site Reviews
≤8.3.5Update to 8.3.6
CVE-2026-118087Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
CVE-2026-118094Oct 29
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
≤7.9.7Update to 7.9.8
CVE-2026-56056Oct 29
Medium4.3
Missing Authorization
JetEngine
≤3.9.0.1Update to 3.9.0.2
CVE-2026-39735Oct 29
Medium5.3
Missing Authorization
Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels
≤7.14.1Update to 7.14.2
CVE-2026-118093Oct 29
Medium5.3
Missing Authorization
YITH PayPal Express Checkout for WooCommerce
≤1.62.0Update to 1.62.1
CVE-2026-27401Oct 29