CVE-2023-26540

WordPress Houzez theme <= 2.7.1 - Privilege Escalation

Improper Privilege Management vulnerability in Favethemes Houzez allows Privilege Escalation.This issue affects Houzez: from n/a through 2.7.1.

CVSS 3.1 · 9.8 Critical EPSS 2.7% KEV · Not listed

Vendors

Favethemes Wordpress

Products

Houzez Wordpress

CVE-2023-25701

WordPress WatchTowerHQ plugin <= 3.6.16 - Privilege Escalation

Improper Privilege Management vulnerability in WhatArmy WatchTowerHQ allows Privilege Escalation.This issue affects WatchTowerHQ: from n/a through 3.6.16.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Watchtowerhq Wordpress

Products

Watchtower Wordpress

CVE-2022-42888

WordPress ARMember Plugin <= 5.5.1 is vulnerable to Privilege Escalation

Unauth. Privilege Escalation vulnerability in ARMember premium plugin <= 5.5.1 on WordPress.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Armemberplugin

Products

Armember

CVE-2026-6741

LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 5.4.1. This is due to a missing authorization check in the execute() method of the connect-customer-to-wp-user ability, which only requires the customer__edit capability granted to the latepoint_agent role by default, without verifying whether the target WordPress user ID belongs to a privileged account. This makes it possible for authenticated attackers with the latepoint_agent role to link any LatePoint customer record to an administrator's WordPress account and subsequently reset the administrator's password via the normal customer password-reset flow, resulting in full site takeover.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Latepoint Wordpress

Products

Latepoint – Calendar Booking Plugin For Appointments And Events Wordpress

CVE-2025-69689

Local Privilege Escalation via Improper Path Handling in Fan Control Open File Dialog

The Fan Control application V251 contains an improper privilege handling vulnerability in its Open File Dialog. The dialog processes user-supplied paths with elevated permissions, which can be exploited by a local attacker to perform actions with administrator-level privileges.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Rem0o

Products

Fan Control

CVE-2025-24254

Privilege Escalation via Symlink Validation Failure

This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A user may be able to elevate privileges.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-31222

Privilege Escalation via Incorrect Privilege Assignment

A correctness issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. A user may be able to elevate privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 3 more

CVE-2025-31243

Permissions flaw enabling root privilege escalation in macOS

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to gain root privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma and 1 more

CVE-2025-43249

Root Privilege Escalation via Improper Logic Checks in Apple macOS

A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to gain root privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma and 1 more

CVE-2026-29647

OpenXiangShan NEMU Cross-Context IMSIC State Leakage

In OpenXiangShan NEMU, insufficient Smstateen permission enforcement allows lower-privileged code to access IMSIC state via stopei/vstopei CSRs even when mstateen0.IMSIC is cleared, potentially enabling cross-context information leakage or disruption of interrupt handling.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openxiangshan

Products

Nemu

CVE-2026-29648

Privilege Escalation via Improper CSRs Access in OpenXiangShan NEMU

In OpenXiangShan NEMU, when Smstateen is enabled, clearing mstateen0.ENVCFG does not correctly restrict access to henvcfg and senvcfg. As a result, less-privileged code may read or write these CSRs without the required exception, potentially bypassing intended state-enable based isolation controls in virtualized or multi-privilege environments.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Openxiangshan

Products

Nemu

CVE-2025-24130

Privilege Escalation by Modifying Protected Filesystem Components

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to modify protected parts of the file system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-24258

Privilege Escalation via Permissions Bypass on macOS

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to gain root privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-24183

macOS Local Privilege Escalation via Improper Filesystem Check

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. A local user may be able to modify protected parts of the file system.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-43256

Privilege Escalation via Improper State Management in macOS

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to gain root privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma

CVE-2025-43188

Privilege Escalation via Permissions Issue in macOS Sequoia

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6. A malicious app may be able to gain root privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia

CVE-2025-24119

macOS Sandbox Escape Allowing Privilege Escalation

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma and 1 more

CVE-2025-43199

macOS Privilege Escalation via Permissions Bypass

A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. A malicious app may be able to gain root privileges.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma and 1 more

CVE-2025-43320

Privileged Code Execution via Launch Constraint Bypass in macOS

The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26. An app may be able to bypass launch constraint protections and execute malicious code with elevated privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia

CVE-2025-12573

Bookingor <= 1.0.12 - Subscriber+ Category Deletion

The Bookingor WordPress plugin through 1.0.12 exposes authenticated AJAX actions without capability or nonce checks, allowing low-privileged users to delete Bookingor WordPress plugin through 1.0.12 data.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress