CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 113)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content
Live Composer – Free WordPress Website Builder
≤2.1.21Update to 2.1.22
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_currency' Parameter and Localization file URL Setting
Hostel
≤1.1.8No patch available
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie
wpForo Forum
≤3.1.5Update to 3.1.6
- High7.2Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source)
WP Yelp Review Slider
≤9.2Update to 9.3
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.18Update to 2.9.19
- High7.12.1.13 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'ids' Parameter
WP Table Builder – Drag & Drop Table Builder
2.1.1 – 2.1.13Update to 2.1.14
- High8.1Unauthenticated Local File Inclusion via 'custom_tpl' Shortcode Attribute via 'woof_draw_products' AJAX
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard
≤1.4.4Update to 1.4.5
- High7.2Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter
WPC Product Bundles for WooCommerce
≤8.6.6Update to 8.6.7
- Medium4.3Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter
Tutor LMS – eLearning and online course solution
≤4.0.7Update to 4.0.8
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action
RW Elephant Rental Inventory
≤2.3.13Update to 2.4.0
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter
Custom Field Template
≤2.7.8Update to 2.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.3Update to 3.15.4
- High7.2Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel
TranslatePress – Translate Multilingual sites with AI Translation
≤3.3.5Update to 3.3.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'other_attributes' Block Parameter
Contextual Related Posts
≤4.4.1Update to 4.4.2
- High7.2Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
≤4.1.17Update to 4.1.18
- Medium6.1Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter
Booking Calendar
≤11.8.3Update to 11.8.4
- Critical9.8Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter
Meta Box User Profile
≤2.5.16Update to 2.6.0
- Critical9.8Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter
Give Tributes
≤2.3.1Update to 2.3.1.1
- Medium4.9Authenticated (Administrator+) SQL Injection
HashBar – Announcement, Notification Bar & Popup Campaign
≤2.0.3Update to 2.0.4
- Medium4.3Missing Authorization
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder
≤5.3Update to 5.4
- Medium4.38.9.4 - Missing Authorization
Directorist: AI-Powered Business Directory, Listings & Classified Ads
3.1.0 – 8.9.4Update to 8.9.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JSM Show Post Metadata
≤4.9.0Update to 4.9.1
- Medium4.3Missing Authorization
Paymob for WooCommerce
≤4.1.13Update to 4.1.14
- Medium4.38.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Directorist: AI-Powered Business Directory, Listings & Classified Ads
8.5 – 8.9.4Update to 8.9.5
- Medium5.36.17.4.1 - Unauthenticated Information Exposure
The Events Calendar
4.5 – 6.17.4.1Update to 6.17.5
- Medium5.3Unauthenticated Information Exposure
WPC Smart Compare for WooCommerce
≤6.6.0Update to 6.6.1
- High7.5Unauthenticated SQL Injection
JetFormBuilder Stripe Gateway
≤1.0.0Update to 1.1.0
- Medium5.3Unauthenticated Information Exposure
NP Quote Request for WooCommerce
≤2.4.15Update to 2.4.16
- Medium4.3Missing Authorization
WC Fields Factory
≤4.1.10Update to 4.1.11
- High8.1Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter
WP Ultimate Review
≤2.4.2Update to 2.4.3