Researchers have uncovered vulnerabilities in a popular WordPress plugin that could be used to escalate privileges and conduct cross-site scripting attacks.