CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 85)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.3Unauthenticated Privilege Escalation
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.7Update to 10.31.9
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Mailster
≤1.9.0.0Update to 1.9.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Form Block
≤1.8.1Update to 1.8.2
- High7.2Unauthenticated Stored Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.9Update to 4.4.9.1
- Medium4.7Authenticated (Editor+) Privilege Escalation
Import and export users and customers
≤2.5.5Update to 2.5.7
- Medium5.3Unauthenticated Information Exposure
SiteVault – Backup, Restore, Migration & Cloning
≤1.5.17Update to 1.5.18
- Medium4.3Missing Authorization
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
≤44.1Update to 45.0
- Medium4.3Missing Authorization
WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments
≤7.1Update to 7.2
- Medium4.3Missing Authorization
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg
≤4.7.7Update to 4.7.8
- Medium6.5Authenticated (Contributor+) SQL Injection
Image Optimizer, Resizer and CDN – Sirv
≤8.2.5Update to 8.2.6
- Medium5.3Unauthenticated Information Exposure
PowerPress Podcasting plugin by Blubrry
≤11.17.9Update to 11.17.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg
≤4.7.7Update to 4.7.8
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
JS Help Desk – AI-Powered Support & Ticketing System
≤4.0.0Update to 5.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Name Directory
≤1.34.2Update to 1.34.3
- Medium4.3Missing Authorization
Event Tickets and Registration
≤5.30.0Update to 5.30.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Presto Player
≤4.5.2Update to 4.5.3
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Name Directory
≤1.34.2Update to 1.34.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.109Update to 4.11.110
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Logo Showcase – Logo Slider, Logo Carousel & Client Logos Grid
≤4.0.4Update to 4.0.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
≤5.14.2Update to 5.15
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
eCommerce Product Catalog
≤3.6.2Update to 3.6.3
- Medium6.5Authenticated (Custom Role+) SQL Injection
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.8.3Update to 4.9
- Medium4.3Authenticated (Subscriber+) Information Exposure
Video Conferencing with Zoom
≤4.6.10Update to 4.6.11
- Medium4.3Missing Authorization
WP Mailster
≤1.9.0.0Update to 1.9.1.0
- Medium4.3Missing Authorization
WP Admin Audit
≤1.2.17Update to 1.2.18
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
JS Help Desk – AI-Powered Support & Ticketing System
≤4.0.0Update to 5.0.0
- Medium4.3Cross-Site Request Forgery
PowerPress Podcasting plugin by Blubrry
≤11.17.9Update to 11.17.11
- Medium4.3Missing Authorization
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress
≤9.1.3Update to 9.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
QR Redirector
≤2.0.5Update to 2.0.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
≤4.17.0Update to 4.18.0