CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 100)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
EWWW Image Optimizer
≤8.7.7Update to 8.8.0
- Medium6.5Authenticated (Contributor+) SQL Injection
BuildKit – Product Builder for WooCommerce – Custom PC Builder
≤1.0.28Update to 1.0.29
- Medium6.5Authenticated (Contributor+) SQL Injection
Pricing Table WordPress Plugin – Easy Pricing Tables
≤4.1.2Update to 4.1.3
- Medium4.3Missing Authorization
Motors – Car Dealership & Classified Listings Plugin
≤1.4.123Update to 1.4.124
- Medium4.9Authenticated (Administrator+) SQL Injection
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤6.4.27Update to 6.4.28
- Medium6.3Authenticated (Subscriber+) Free Paid Course Enrollment
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators
≤1.2.19Update to 1.2.20
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Flexible PDF Coupons – Gift Cards & Vouchers for WooCommerce
≤1.14.11Update to 1.14.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Qi Addons For Elementor
≤1.11Update to 1.11.1
- Medium6.1Reflected Cross-Site Scripting
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.13.1Update to 3.13.2
- High7.2Authenticated (Shop Manager+) Arbitrary CSS Injection
Astra
≤4.13.12Update to 4.14.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder
≤2.5.63Update to 2.5.64
- Medium4.7Unauthenticated Open Redirect
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers
≤1.12.26Update to 1.12.27
- Medium5.3Unauthenticated Information Exposure
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
≤4.2.3Update to 4.2.4
- Medium4.3Cross-Site Request Forgery
Razorpay Payment Links for WooCommerce
≤2.1.5Update to 2.2.0
- Medium6.5Authenticated (Contributor+) SQL Injection
Media Library Assistant
≤3.41Update to 3.42
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP OAuth Server (OAuth Authentication)
≤4.5.1Update to 4.5.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Strong Testimonials
≤3.3.11Update to 3.3.12
- Medium5.3Unauthenticated Insecure Direct Object Reference
SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO
≤3.1.0Update to 3.1.1
- Medium4.3Missing Authorization
Prevent Files / Folders Access
≤2.6.7Update to 2.6.8
- Medium4.34.22.0 - Authenticated (Subscriber+) Payment Bypass
MStore API – Create Native Android & iOS Apps On The Cloud
4.21.1 – 4.22.0Update to 4.22.1
- Medium6.5Authenticated (Author+) SQL Injection
Quiz Cat – WordPress Quiz Plugin
≤3.1.1Update to 3.2.0
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- Medium6.4Authenticated (Listing Manager+) Stored Cross-Site Scripting
Motors – Car Dealership & Classified Listings Plugin
≤1.4.123Update to 1.4.124
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
User Submitted Posts – Enable Users to Submit Posts from the Front End
≤20260810Update to 20260916
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates
≤3.23.1Update to 3.50.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.105Update to 4.11.106
- Medium4.9Authenticated (Shop Manager+) SQL Injection via Exchange Rate Field
WPML Multilingual & Multicurrency for WooCommerce
≤5.5.7Update to 5.5.8
- Medium4.3Cross-Site Request Forgery
Photo Gallery by Supsystic – Image Gallery, Masonry, Albums & Lightbox
≤1.21.0Update to 1.21.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
CF7 Views – Complete Entry Management for Contact Form 7
≤3.2.5Update to 3.2.6