CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 54)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.0Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption
Search Regex
≤3.5Update to 3.5.1
- Critical9.8Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter
Theme My Login
≤7.2.1Update to 7.2.2
- High7.5Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.34.5Update to 2.34.8
- Medium6.5Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter
Tainacan
≤1.3.0Update to 1.4.0
- Critical9.8Unauthenticated Arbitrary File Upload via IMAP Email Attachment
ELEX WordPress HelpDesk & Customer Ticketing System
≤3.3.7Update to 3.3.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field
SQL Chart Builder
≤3.0.6Update to 3.0.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
Hide My WP Ghost – Security & Firewall
≤7.0.12Update to 7.0.13
- Medium6.1Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter
Tutor LMS – eLearning and online course solution
≤4.0.8Update to 4.0.9
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta
Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated
≤4.11.1Update to 4.11.2
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector
SiteOrigin CSS
≤1.6.7Update to 1.6.8
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink
SiteOrigin CSS
≤1.6.7Update to 1.6.8
- Medium5.3Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant
Lightweight Cookie Notice – Cookie Banner for Cookie Consent
≤1.19Update to 1.20
- High7.2Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter
Schema & Structured Data for WP & AMP
≤1.67Update to 1.68
- Medium6.1Reflected Cross-Site Scripting
PAYCOMET for WooCommerce
≤5.45Update to 5.46
- High7.2Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.9Update to 10.31.10
- High7.2Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}
Simply Schedule Appointments
≤1.6.12.35Update to 1.6.12.37
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute
Quick PayPal Payments: Payment Button & Form
≤6.0.4Update to 6.0.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.3Update to 4.0.4
- High8.1Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.3Update to 4.0.4
- High7.2Unauthenticated Stored Cross-Site Scripting via First Name Field
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.3Update to 4.0.4
- High8.8Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter
PilotPress
≤2.0.43Update to 2.0.44
- High7.2Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
≤3.3.3Update to 3.3.4
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter
Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights
≤1.9.2.1Update to 1.10.0
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter
Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights
≤1.9.2.1Update to 1.10.0
- Critical9.8Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute
My Calendar – Accessible Event Manager
≤3.8.7Update to 3.4.25 or 3.5.22 or 3.6.18 or 3.7.18 or 3.8.8
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
≤3.3.3Update to 3.3.4
- High7.5Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter
Nexter Extension – Security, Performance, Code Snippets & Site Toolkit
≤4.7.11Update to 4.7.12
- High8.1Unauthenticated Authentication Bypass via Delay OTP Grace State
miniOrange OTP Login, Verification and SMS Notifications
≤5.5.8Update to 5.6.0
- High7.5Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT
Modula Image Gallery – Photo Grid & Video Gallery
≤3.0.11Update to 3.0.12
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter
Mang Board
≤2.4.4Update to 2.4.5