CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 114)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.0.0Update to 3.1.0
- Medium5.3Unauthenticated CAPTCHA Bypass
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.0.0Update to 3.1.0
- Medium5.32.0.15 - Unauthenticated Information Exposure
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
1.95 – 2.0.15Update to 2.1.0
- Medium5.3Missing Authorization
Paymob for WooCommerce
≤4.1.13Update to 4.1.14
- Medium4.36.17.4.1 - Missing Authorization
The Events Calendar
6.15.0 – 6.17.4.1Update to 6.17.5
- Medium5.3Unauthenticated Poll Vote Limit Bypass
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1
- Medium5.310.8.1 - Unauthenticated Arbitrary User Meta Corruption
WP Recipe Maker
9.8.0 – 10.8.1Update to 10.8.2
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.9.4Update to 8.9.5
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.9.4Update to 8.9.5
- Medium4.38.9.4 - Missing Authorization
Directorist: AI-Powered Business Directory, Listings & Classified Ads
8.9.1 – 8.9.4Update to 8.9.5
- Medium5.38.9.4 - Unauthenticated Information Exposure
Directorist: AI-Powered Business Directory, Listings & Classified Ads
8.1 – 8.9.4Update to 8.9.5
- High8.8Authenticated (Subscriber+) Arbitrary User Identity Token Issuance to Privilege Escalation
WP OAuth Server ( Login with WordPress )
≤6.3.0Update to 6.4.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Payment Plugins for PayPal WooCommerce
≤2.0.26Update to 2.0.27
- Medium5.3Unauthenticated Payment Manipulation
Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More
≤2.3.3Update to 2.3.4
- Critical9.8Unauthenticated Remote Code Execution
YAHMAN Add-ons
≤0.9.30Update to 0.9.31
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Ditty – Responsive News Tickers, Sliders, and Lists
≤3.1.69Update to 3.1.70
- Medium5.37.5.1 - Unauthenticated Information Exposure
Product Badge, Label, Countdown Timer for WooCommerce – Sale Booster
7.0.0 – 7.5.1Update to 7.5.2
- Medium5.3Unauthenticated Information Exposure
Post Grid Gutenberg Blocks – PostX
≤5.0.40Update to 5.0.41
- Medium4.310.8.1 - Authenticated (Subscriber+) Information Exposure
WP Recipe Maker
10.3.0 – 10.8.1Update to 10.8.2
- Medium6.3Authenticated (Subscriber+) HTML Injection
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium4.3Missing Authorization
Zportals
≤6.4.1Update to 6.4.2
- Medium5.3Unauthenticated Forged Payment and Subscription Events
Premium Packages – Sell Digital Products Securely
≤7.2.0Update to 7.2.1
- Medium4.3Missing Authorization
WC Fields Factory
≤4.1.10Update to 4.1.11
- Medium6.41.6.2 - Authenticated (Author+) Stored Cross-Site Scripting
Subscribe Forms – Beautiful Email Forms, Embedded Newsletter Forms & MailChimp Form
1.4.1 – 1.6.2Update to 1.6.3
- Medium6.5Authenticated (Author+) SQL Injection
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar
≤2.1.20Update to 2.1.21
- Medium5.3Missing Authorization
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1
- Medium4.3Missing Authorization
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Translate WordPress with GTranslate
≤5.0.0Update to 5.0.1
- Medium5.3Unauthenticated Information Exposure
Easy Hide Login
≤1.6Update to 1.7
- Medium5.3Missing Authorization
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤5.9.34Update to 5.9.35