CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 30)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Payable Payment Gateway for WooCommerce
≤1.3.0Update to 1.3.1
- Medium5.39.18 - Unauthenticated Information Exposure
Quick Event Manager
8.4.6 – 9.18Update to 9.19
- Medium4.3Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium4.3Authenticated (Custom+) Path Traversal
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium5.3Unauthenticated Arbitrary Content Injection
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content
≤0.8.8Update to 0.8.9
- Low3.5Authenticated (Subscriber+) Arbitrary Page Content Injection
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.4.0Update to 6.4.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.3.0Update to 5.3.1
- Medium5.3Missing Authorization to Unauthenticated Information Exposure
Bricks Theme
≤2.4.0Update to 2.4.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
<4.2.5No patch available
- Medium6.42.6.8 - Authenticated (Shop Manager+) Server-Side Request Forgery
Product Import Export for WooCommerce – CSV Product Importer & Exporter
2.5.1 – <2.6.8Update to 2.6.8
- Medium5.3Missing Authorization
Mapster WP Maps
≤2.0.5Update to 2.0.6
- Medium5.3Unauthenticated Information Exposure
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤4.0.0Update to 5.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Firelight Lightbox
≤2.3.23Update to 2.3.24
- Medium5.32.10.0 - Unauthenticated Arbitrary Guest Attachment Deletion
BuddyForms
2.8.8 – 2.10.0Update to 2.10.1
- Medium4.3Two-Factor Authentication via Brute Force
Security Optimizer – The All-In-One Protection Plugin
≤1.6.8Update to 1.6.9
- Medium5.3Missing Authorization
Premium Packages – Sell Digital Products Securely
≤7.2.1Update to 7.2.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Media Library Assistant
≤3.42Update to 3.43
- Medium6.5Authenticated (Author+) Path Traversal
Bulk Media Register
≤2.0Update to 2.01
- Medium4.7SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.12.9 -Unauthenticated Arbitrary HTML Injection
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.12.9Update to 2.13.0
- High7.25.16.4 - Unauthenticated Stored Cross-Site Scripting
PDF Invoices & Packing Slips For WooCommerce
5.16.2 – 5.16.4Update to 5.16.5
- Medium6.36.8.7 - Authenticated (Author+) Privilege Escalation
Essential Addons for Elementor – Popular Elementor Templates & Widgets
6.6.0 – 6.8.7Update to 6.8.8
- Medium4.3Authenticated (Contributor+) Information Exposure
Payment Forms for Paystack
≤4.0.5Update to 4.0.6
- Medium5.32.4.5 - Unauthenticated Payment Bypass
PayHere Payment Gateway
2.4.0 – 2.4.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters
NewsmanApp
≤3.7.29Update to 3.7.32
- Medium5.3Unauthenticated Sensitive Information Exposure in 'post_id' Parameter
MW WP Form
≤5.1.7Update to 5.1.8
- Medium4.9Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys
Meta Box – A Framework for Dynamic Websites
≤5.15.2Update to 5.15.3
- High7.5Unauthenticated SQL Injection via 'slug' Parameter
Newsmatic
≤1.5.0Update to 1.5.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Content-Type Header
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.3.2Update to 9.3.3
- Medium4.7Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links
Media Library Assistant
≤3.42Update to 3.43
- High7.2Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter
Mapster WP Maps
≤2.0.5Update to 2.0.6