CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 91)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
≤3.0.19Update to 3.0.20
- Critical9.1Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter
VikAppointments Services Booking Calendar
≤1.2.21Update to 1.2.22
- High8.8Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter
Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet)
≤8.97.0Update to 8.98.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Responsive Starter Templates – Elementor Templates & Starter Sites
≤3.5.3Update to 3.5.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write
Wp Social Login and Register Social Counter
≤3.2.1Update to 3.2.2
- Medium4.9Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_matomo_id' Parameter
SEOPress – AI SEO Plugin & On-site SEO
≤10.2Update to 10.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Author Display Name
SEOPress – AI SEO Plugin & On-site SEO
≤10.2Update to 10.3
- Medium6.1Reflected Cross-Site Scripting via 'woosq-redirect' Parameter
WPC Smart Quick View for WooCommerce
≤4.4.0Update to 4.4.1
- High8.1Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter
Revopic – Photo Reviews for WooCommerce
≤1.2.30Update to 1.2.31
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)
Rich Showcase for Google Reviews
≤7.1.3Update to 7.1.4
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header
Visitor Traffic Real Time Statistics
≤8.16Update to 8.17
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out Widget
Ultra Addons Lite for Elementor
≤1.3.2Update to 1.3.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters
Welcart e-Commerce
≤2.12.2Update to 2.12.3
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via 'id' Parameter
Helpdesk Support Ticket System for WooCommerce
≤2.1.6Update to 2.2.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field
Strong Testimonials
≤3.3.11Update to 3.3.12
- Medium5.3Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`…
WPZOOM Connect: Social Icons Widget & Block, Share Buttons & Click to Chat
≤4.7.3Update to 4.7.4
- High7.5Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints
Simple Membership
≤4.8.3Update to 4.8.4
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder
Transliterator – Multilingual and Multi-script Text Conversion
≤2.5.8Update to 2.5.9
- High7.2Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author
Magic Tooltips For Contact Form 7
≤1.0.34Update to 1.0.35
- High7.5Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.186Update to 2.8.187
- Medium6.1Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤5.5.1.5Update to 5.5.1.6
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification via atai_enrich_post_content AJAX Action
Alt Text AI – Automatically generate image alt text for SEO and accessibility
≤1.10.41Update to 1.10.42
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
≤5.0.2Update to 5.0.2.1
- Medium4.3Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
≤4.0.1Update to 4.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment
Real Cookie Banner: GDPR & ePrivacy Cookie Consent
≤5.3.5Update to 5.3.6
- Medium4.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.10Update to 4.4.11
- Medium4.3Authenticated (Subscriber+) Information Exposure
Mindio Magic MCP
≤0.5.6Update to 0.7.1
- High8.8Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.9Update to 4.9.1
- Medium4.3Missing Authorization
WDS MCP Content Manager
≤3.10.4No patch available
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Issues and Series for Newspapers, Magazines, Publishers, Writers
≤3.1.3Update to 3.1.4