Skip to content
Noroxi

CWE-266 · 1,169 records

Incorrect Privilege Assignment

CVEs in this class

1,173 records

  • CVE-2026-48172
    70This week

    LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026.

    CriticalCVSS 10.0KEVWeaponizedEPSS 1%

    litespeedtech · litespeed cpanel pluginMay 20, 2026

  • CVE-2024-28000
    59Plan

    WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 68%

    litespeedtech · litespeed cacheAug 21, 2024

  • CVE-2025-27007
    55Plan

    WordPress SureTriggers <= 1.0.82 - Privilege Escalation Vulnerability

    CriticalCVSS 9.8WeaponizedEPSS 54%

    brainstorm force · ottokitMay 1, 2025

  • CVE-2025-47539
    47Plan

    WordPress Eventin plugin <= 4.0.26 - Privilege Escalation Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 28%

    themewinter · eventinMay 23, 2025

  • CVE-2026-23550
    46Plan

    WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 22%

    modular ds · modular dsJan 14, 2026

  • CVE-2025-41115
    44Plan

    Incorrect privilege assignment

    CriticalCVSS 9.8Proof of conceptEPSS 17%

    grafana · grafanaNov 21, 2025

  • CVE-2022-20759
    43Plan

    Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Privilege Escalation Vulnerability

    HighCVSS 8.8No exploitEPSS 28%

    cisco · secure firewall threat defenseMay 3, 2022

  • CVE-2025-49388
    41Plan

    WordPress Miraculous Core Plugin Plugin <= 2.0.7 - Privilege Escalation Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 6%

    kamleshyadav · miraculous core pluginAug 28, 2025

  • CVE-2024-24882
    40Plan

    WordPress LMS by Masteriyo plugin <= 1.7.2 - Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    themegrill · masteriyoMay 17, 2024

  • CVE-2024-54363
    40Plan

    WordPress Wp NssUser Register plugin <= 1.0.0 - Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    saiful.total · wp nssuser registerDec 16, 2024

  • CVE-2026-27542
    40Plan

    WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    rymera web co pty ltd. · woocommerce wholesale lead captureMar 19, 2026

  • CVE-2026-23800
    40Plan

    WordPress Modular DS plugin <= 2.5.2 - Privilege Escalation vulnerability

    CriticalCVSS 10.0No exploitEPSS 1%

    Jan 16, 2026

  • CVE-2024-9478
    40Plan

    Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue a

    CriticalCVSS 10.0No exploitEPSS 0%

    upkeeper solutions · upkeeper instant privilege accessNov 20, 2024

  • CVE-2024-9479
    40Plan

    Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue a

    CriticalCVSS 10.0No exploitEPSS 0%

    upkeeper solutions · upkeeper instant privilege accessNov 20, 2024

  • CVE-2026-49060
    39Monitor

    WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    hippoo · hippoo mobile app for woocommerceJun 11, 2026

  • CVE-2019-10940
    39Monitor

    A vulnerability has been identified in SINEMA Server (All versions < V14.0 SP2 Update 1).

    CriticalCVSS 9.9No exploitEPSS 1%

    siemens · sinema serverJan 16, 2020

  • CVE-2024-54383
    39Monitor

    WordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Broken Authentication vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    wpwebelite · woocommerce pdf vouchersDec 18, 2024

  • CVE-2024-50485
    39Monitor

    WordPress Exam Matrix plugin <= 1.5 - Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    udit rawat · exam matrixOct 29, 2024

  • CVE-2024-50550
    39Monitor

    WordPress LiteSpeed Cache plugin <= 6.5.1 - Privilege Escalation vulnerability

    CriticalCVSS 9.8No exploitEPSS 1%

    litespeedtech · litespeed cacheOct 29, 2024

  • CVE-2024-2409
    39Monitor

    MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action

    CriticalCVSS 9.8No exploitEPSS 1%

    stylemixthemes · masterstudy lmsMar 29, 2024

  • CVE-2022-4272
    39Monitor

    FeMiner wms unrestricted upload

    CriticalCVSS 9.8No exploitEPSS 1%

    warehouse management system project · warehouse management systemDec 3, 2022

  • CVE-2022-4273
    39Monitor

    SourceCodester Human Resource Management System Content-Type employee.php unrestricted upload

    CriticalCVSS 9.8No exploitEPSS 1%

    oretnom23 · human resource management systemDec 3, 2022

  • CVE-2025-32491
    39Monitor

    WordPress Rankology SEO – On-site SEO plugin <= 2.2.4 - Privilege Escalation Vulnerability

    CriticalCVSS 9.8No exploitEPSS 1%

    rankology · rankology seo – on-site seoApr 11, 2025

  • CVE-2024-13421
    39Monitor

    Real Estate 7 WordPress <= 3.5.1 - Unauthenticated Privilege Escalation to Administrator

    CriticalCVSS 9.8No exploitEPSS 1%

    contempothemes · real estate 7Feb 12, 2025

  • CVE-2024-56040
    39Monitor

    WordPress VibeBP plugin <= 1.9.9.4.1 - Unauthenticated Privilege Escalation vulnerability

    CriticalCVSS 9.8No exploitEPSS 1%

    vibethemes · vibebpDec 31, 2024

All vulnerability classes