CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 110)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Online Booking & Scheduling Calendar by vcita
≤4.6.0Update to 4.6.3
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Reycob Product Import Export
≤2.3.0Update to 2.4.0
- Medium5.3Missing Authorization
Tangible: Loops & Logic
≤4.2.4Update to 4.3.0
- Medium5.3Missing Authorization
Conekta Payment Gateway
≤6.2.4Update to 6.2.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Mang Board
≤2.4.1Update to 2.4.2
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Photo Album Plus
≤9.3.02.002Update to 9.3.02.003
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
wpForo Forum
≤3.1.5Update to 3.1.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤5.5.1.1Update to 5.5.1.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Event Tickets and Registration
≤5.29.4Update to 5.29.5
- High7.2Unauthenticated Stored Cross-Site Scripting
WPS Limit Login
≤1.5.9.3Update to 1.5.9.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
PixelYourSite – Your smart PIXEL (TAG) & API Manager
≤11.4.1Update to 11.4.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.3Update to 3.15.4
- Medium5.3Missing Authorization
AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker)
≤3.15.4Update to 3.15.5
- Medium4.9Authenticated (Administrator+) SQL Injection
Email Log
≤2.63Update to 2.64
- Medium4.9Authenticated (Editor+) SQL Injection
Ultimeter – the Ultimate Progress and Goals Meter
≤3.0.8Update to 3.1.0
- Medium6.5Authenticated (Contributor+) SQL Injection
WP EasyCart: Shopping Cart and eCommerce Store
≤5.9.4Update to 6.0.0
- Medium6.5Authenticated (Contributor+) SQL Injection
Mollie Forms
≤2.11.0Update to 2.11.1
- Medium6.5Authenticated (Contributor+) SQL Injection
Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator
≤1.5.10Update to 1.5.11
- Medium4.3Missing Authorization
Fluent Support – Helpdesk & Customer Support Ticket System
≤2.3.2Update to 2.4.0
- Medium4.9Authenticated (Shop Manager+) SQL Injection
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.7.0Update to 3.7.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Blocks – Gutenberg Blocks, Patterns & Templates
≤2.3.17Update to 2.3.18
- High8.8Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields
Import and export users and customers
≤2.4.17Update to 2.4.18
- Medium5.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
≤2.1.70Update to 2.1.72
- High8.1Unauthenticated Authentication Bypass
EthPress – Web3 Login
≤2.3.5Update to 2.3.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
≤7.9.5Update to 7.9.6
- Medium5.3Unauthenticated Insecure Direct Object Reference
YITH Request a Quote for WooCommerce (Premium)
<4.46.1Update to 4.46.1
- High7.5Unauthenticated SQL Injection
Product Filter for WooCommerce by WBW
≤3.1.7Update to 3.1.8
- Medium4.3Missing Authorization to Authenticated (Contributor+) Unauthorized Post and Media Modification
WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents
≤2.7.0Update to 2.7.1
- Medium5.3Unauthenticated Unauthorized User Registration
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.11Update to 4.3.12
- Medium6.3Authenticated (Subscriber+) Subscription Gate Bypass on Post Submission
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.11Update to 4.3.12