CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 115)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Subscriber+) Information Exposure
Zportals
≤6.4.1Update to 6.4.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
Newsletters
≤4.18.0Update to 4.18.1
- Medium5.3Unauthenticated IP Spoofing to Protection Bypass
Divi Dash
≤1.0.6Update to 1.0.7
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder
≤5.3Update to 5.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates
≤3.49.0Update to 3.50.0
- Medium4.36.17.4.1 - Missing Authorization
The Events Calendar
6.15.16.1 – 6.17.4.1Update to 6.17.5
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium4.3Missing Authorization
Points and Rewards for WooCommerce – Create Loyalty Programs, Reward Customer Purchases, Referral Points, User Badges, and Gamification
≤2.10.3Update to 2.10.4
- Medium4.35.7.2 - Missing Authorization
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
5.3.6 – 5.7.2Update to 5.7.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar
≤2.1.20Update to 2.1.21
- Medium5.3Unauthenticated Payment Bypass
Paymob for WooCommerce
≤4.1.13Update to 4.1.14
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Post Meta Injection
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Ninja Tables – Responsive Table Builder for Data, Pricing & Product Tables
≤5.2.16Update to 5.2.17
- Medium4.3Authenticated (Subscriber+) Information Exposure
WP Recipe Maker
≤10.8.1Update to 10.8.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
WP Recipe Maker
≤10.8.1Update to 10.8.2
- Medium5.3Missing Authorization
Social Commerce for WooCommerce
≤2.5.4No patch available
- Medium5.31.2.5 - Unauthenticated Information Exposure
Lightbox
1.2.2 – 1.2.5No patch available
- Medium5.3Missing Authorization
E-cab Taxi Booking Manager for Woocommerce
<2.0.8Update to 2.0.8
- Critical9.8Unauthenticated Arbitrary File Upload
Web to Print Online Designer
≤2.14.0Update to 2.15.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions
Partial Shipment for WooCommerce
≤3.4Update to 3.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'pop_tag' Widget Setting
Gum Addon for Elementor
≤1.3.15Update to 1.3.16
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action
Empik for Woocommerce
≤1.5.1Update to 1.5.2
- Medium5.3Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints
WordLift – AI powered SEO – Schema
≤3.54.10Update to 3.54.14
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input
Redux Framework
≤4.5.13Update to 4.5.14
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)
Datalogics Ecommerce Delivery – Datalogics
≤2.6.65Update to 2.6.66
- Medium5.3Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter
TikTok
≤1.4.1Update to 1.4.2
- Medium6.4Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input
YS LeadGen – Popup Builder, Contact Form Builder, Exit Intent, Optin Forms & Lead Generation
≤2.1.4Update to 2.1.5
- Medium4.7Reflected Cross-Site Scripting via ESI 'esi' Parameter
LiteSpeed Cache
≤7.9Update to 7.9.1
- High7.5Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action
YS LeadGen – Popup Builder, Contact Form Builder, Exit Intent, Optin Forms & Lead Generation
≤2.1.4Update to 2.1.5
- Medium4.9Authenticated (Administrator+) SQL Injection via 's' Parameter
WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals
≤2.5.0Update to 2.6.0