CWE-269Vulnerability type
WordPress Privilege Escalation vulnerabilities (page 93)
Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated SQL Injection
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- High7.5Authenticated (Contributor+) PHP Object Injection
Unlimited Elements for Elementor
≤2.0.19Update to 2.0.20
- Medium6.1Reflected Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- High7.2Unauthenticated Stored Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.19Update to 2.0.20
- High7.2Unauthenticated Stored Cross-Site Scripting
TranslatePress – Translate Multilingual sites with AI Translation
≤3.3.6Update to 3.3.7
- Medium5.3Missing Authorization
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2Update to 1.57.3
- Medium5.3Unauthenticated Payment Bypass
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2Update to 1.57.2.1
- Medium6.1Reflected Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤14.16.14Update to 14.16.15
- High7.2Unauthenticated Stored Cross-Site Scripting
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.7.11.1Update to 3.7.12
- High8.1Unauthenticated PHP Object Injection
The Events Calendar
≤6.17.4Update to 6.17.4.1
- Medium5.3Missing Authorization
User Private Files – Secure File Sharing and Client Portal Plugin
≤2.1.0Update to 2.2.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Razorpay for WooCommerce
≤4.8.7Update to 4.8.8
- Medium5.3Unauthenticated Payment Bypass
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.8.1Update to 4.16.9
- High7.5Unauthenticated SQL Injection
WPLMS Plugin
<1.9.9.8.2Update to 1.9.9.8.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX
GD Rating System
≤3.7.1Update to 3.7.2
- High7.3Missing Authorization to Unauthorized Redirects
Aculect AI Companion
≤0.8.2Update to 0.8.3
- Medium4.32.3.21 - Authenticated (Author+) Information Exposure
Five Star Business Profile and Schema
2.3.20 – 2.3.21Update to 2.4.0
- Medium5.31.7.5 - Unauthenticated Insecure Direct Object Reference
File Uploads Addon for WooCommerce
1.7.2 – 1.7.5Update to 1.7.6
- Medium4.3Missing Authorization
IATO MCP
≤1.12.0Update to 1.12.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
≤5.0.2.0Update to 5.0.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ThemeREX Addons
≤2.46.0Update to 2.47.0
- High8.84.9.6 - Cross-Site Request Forgery to Privilege Escalation
CoCart – Headless REST API for WooCommerce
4.9.0 – 4.9.6Update to 4.9.7
- Medium5.3Unauthenticated Insecure Direct Object Reference
UPI QR Code Payment Gateway
<1.4.4Update to 1.4.4
- Medium5.3Unauthenticated Duplicate Slot Booking
Booking Calendar
≤11.8.4Update to 11.9
- Medium5.3Missing Authorization
File Uploads Addon for WooCommerce
≤1.7.6Update to 1.7.7
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Simple Shopping Cart
≤5.2.5Update to 5.2.6
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
ThemeREX Addons
≤2.46.0Update to 2.47.0
- Critical9.8Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter
WPMobile.App – Android and iOS App Builder
≤11.82Update to 11.85
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
W3 Total Cache
≤2.10.6Update to 2.10.7
- Medium6.1Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤14.16.14Update to 14.16.15