CVE-2024-37560

WordPress WP User Switch plugin <= 1.1.0 - Privilege Escalation vulnerability

Improper Privilege Management vulnerability in IqbalRony WP User Switch allows Privilege Escalation.This issue affects WP User Switch: from n/a through 1.1.0.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Iqbalrony

Products

Wp User Switch

CVE-2024-37952

WordPress BookYourTravel theme <= 8.18.17 - Subscriber+ Privilege Escalation vulnerability

Improper Privilege Management vulnerability in themeenergy BookYourTravel allows Privilege Escalation.This issue affects BookYourTravel: from n/a through 8.18.17.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Themeenergy

Products

Book Your Travel Bookyourtravel

CVE-2024-34370

WordPress EAN for WooCommerce plugin <= 4.8.9 - Arbitrary Option Update to Privilege Escalation vulnerability

Improper Privilege Management vulnerability in WPFactory EAN for WooCommerce allows Privilege Escalation.This issue affects EAN for WooCommerce: from n/a through 4.8.9.

CVSS 3.1 · 7.2 High EPSS 1.1% KEV · Not listed

Vendors

Wpfactory

Products

Ean For Woocommerce

CVE-2023-51425

WordPress Rencontre plugin <= 3.10.1 - Unauthenticated Account Takeover vulnerability

Improper Privilege Management vulnerability in Jacques Malgrange Rencontre – Dating Site allows Privilege Escalation.This issue affects Rencontre – Dating Site: from n/a through 3.10.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2023-51424

WordPress WebinarIgnition plugin <= 3.05.0 - Unauthenticated Privilege Escalation vulnerability

Improper Privilege Management vulnerability in Saleswonder Team WebinarIgnition allows Privilege Escalation.This issue affects WebinarIgnition: from n/a through 3.05.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Saleswonder

Products

Webinarignition

CVE-2023-47868

WordPress wpForo plugin <= 2.2.3 - Privilege Escalation vulnerability

Improper Privilege Management vulnerability in wpForo wpForo Forum allows Privilege Escalation.This issue affects wpForo Forum: from n/a through 2.2.3.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Gvectors

Products

Wpforo Forum

CVE-2023-46145

WordPress Themify Ultra theme <= 7.3.5 - Authenticated Privilege Escalation vulnerability

Improper Privilege Management vulnerability in Themify Themify Ultra allows Privilege Escalation.This issue affects Themify Ultra: from n/a through 7.3.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Themify

Products

Ultra

CVE-2023-41665

WordPress GiveWP plugin <= 2.33.0 - GiveWP Manager+ Privilege Escalation vulnerability

Improper Privilege Management vulnerability in GiveWP allows Privilege Escalation.This issue affects GiveWP: from n/a through 2.33.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2023-26540

WordPress Houzez theme <= 2.7.1 - Privilege Escalation

Improper Privilege Management vulnerability in Favethemes Houzez allows Privilege Escalation.This issue affects Houzez: from n/a through 2.7.1.

CVSS 3.1 · 9.8 Critical EPSS 2.7% KEV · Not listed

Vendors

Favethemes Wordpress

Products

Houzez Wordpress

CVE-2023-25701

WordPress WatchTowerHQ plugin <= 3.6.16 - Privilege Escalation

Improper Privilege Management vulnerability in WhatArmy WatchTowerHQ allows Privilege Escalation.This issue affects WatchTowerHQ: from n/a through 3.6.16.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Watchtowerhq Wordpress

Products

Watchtower Wordpress

CVE-2022-42888

WordPress ARMember Plugin <= 5.5.1 is vulnerable to Privilege Escalation

Unauth. Privilege Escalation vulnerability in ARMember premium plugin <= 5.5.1 on WordPress.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Armemberplugin

Products

Armember

CVE-2022-36387

WordPress About Me plugin <= 1.0.12 - Broken Access Control vulnerability

Broken Access Control vulnerability in Alessio Caiazza's About Me plugin <= 1.0.12 at WordPress.

CVSS 3.1 · 7.6 High EPSS 1.0% KEV · Not listed

Vendors

About-me Project

Products

About-me

CVE-2022-36375

WordPress Tabs plugin <= 3.6.0 - Authenticated WordPress Options Change vulnerability

Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed

Vendors

Oxilab

Products

Responsive Tabs

CVE-2022-34868

WordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Authenticated Arbitrary Settings Update vulnerability

Authenticated Arbitrary Settings Update vulnerability in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed

Vendors

Yookassa

Products

Yukassa For Woocommerce

CVE-2026-6741

LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 5.4.1. This is due to a missing authorization check in the execute() method of the connect-customer-to-wp-user ability, which only requires the customer__edit capability granted to the latepoint_agent role by default, without verifying whether the target WordPress user ID belongs to a privileged account. This makes it possible for authenticated attackers with the latepoint_agent role to link any LatePoint customer record to an administrator's WordPress account and subsequently reset the administrator's password via the normal customer password-reset flow, resulting in full site takeover.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Latepoint Wordpress

Products

Latepoint – Calendar Booking Plugin For Appointments And Events Wordpress

CVE-2025-69689

Local Privilege Escalation via Improper Path Handling in Fan Control Open File Dialog

The Fan Control application V251 contains an improper privilege handling vulnerability in its Open File Dialog. The dialog processes user-supplied paths with elevated permissions, which can be exploited by a local attacker to perform actions with administrator-level privileges.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Rem0o

Products

Fan Control

CVE-2025-24254

Privilege Escalation via Symlink Validation Failure

This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A user may be able to elevate privileges.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-31222

Privilege Escalation via Incorrect Privilege Assignment

A correctness issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. A user may be able to elevate privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 3 more

CVE-2025-31243

Permissions flaw enabling root privilege escalation in macOS

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to gain root privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma and 1 more

CVE-2025-43249

Root Privilege Escalation via Improper Logic Checks in Apple macOS

A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to gain root privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma and 1 more