CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 106)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter
Premium Packages – Sell Digital Products Securely
≤7.2.1Update to 7.2.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
≤4.9.8Update to 5.0.0
- High7.5Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
≤4.9.8Update to 5.0.0
- Medium5.5Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter
Asset CleanUp: Page Speed Booster
≤1.4.0.5Update to 1.4.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter
Themify Builder
≤7.8.1Update to 7.8.2
- Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter
SSL Zen — SSL Certificate Installer & HTTPS Redirects
≤4.7.42Update to 4.7.43
- Medium6.1Reflected Cross-Site Scripting via 'uri' Parameter
SSL Zen — SSL Certificate Installer & HTTPS Redirects
≤4.7.42Update to 4.7.43
- High8.8Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Return
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
≤260814Update to 260829
- High7.2Unauthenticated Stored Cross-Site Scripting via Repeater Field Value
Repeater Fields for Elementor Forms
≤2.2.7Update to 2.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Avatar Field
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.2Update to 4.0.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.2Update to 4.0.3
- High7.3Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJAX Action to Author Role Assignment
Optima Express IDX
≤8.7.5Update to 8.7.6
- High7.2Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter
Restaurant Menu and Food Ordering
≤2.4.14Update to 2.4.15
- High7.5Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters
Modula Image Gallery – Photo Grid & Video Gallery
≤3.0.1Update to 3.0.2
- High8.1Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter
Modula Image Gallery – Photo Grid & Video Gallery
≤3.0.2Update to 3.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter
Fancy Product Designer
≤6.5.2Update to 6.5.3
- High8.8Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more
≤9.6.1.0Update to 9.6.2.0
- Medium6.1Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.5.3Update to 3.6.5.4
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume
HT Contact Form – Drag & Drop Form Builder for WordPress
≤2.10.1Update to 2.10.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute
Gutenverse – WordPress Blocks, Page Builder & Site Editor
≤4.0.8Update to 4.0.9
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.183Update to 2.8.184
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.181Update to 2.8.182
- High7.2Unauthenticated Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta
Fancy Product Designer
≤6.5.2Update to 6.5.3
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint
OpenStation – Admin Dashboard Notes, Custom Dashboard, AI Assistant & PWA
≤1.1.7Update to 1.1.8
- Critical9.1Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter
Customer Reviews for WooCommerce
≤5.120.0Update to 5.121.0
- Medium6.4Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤3.0.4Update to 3.0.5
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤3.0.4Update to 3.0.5
- Critical9.1Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium5.3Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via Multiple AJAX Handlers
Blog2Social: Social Media Auto Post & Scheduler
≤9.1.0Update to 9.1.1