VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-434Vulnerability type

WordPress Arbitrary File Upload vulnerabilities (page 119)

Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.

Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Arbitrary File Upload vulnerabilities (page 119)
SeverityVulnerabilityCVEInstallsPublished
Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid≤1.8.6Update to 1.8.7
CVE-2026-75017—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attribute
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid≤1.8.6Update to 1.8.7
CVE-2026-75016—
Medium6.5Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key
InfiniteWP Client≤1.13.9Update to 1.13.10
CVE-2026-17576—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option_key' Parameter of toggle_watermark AJAX Action
Foxtool All-in-One: Contact chat button, Custom login, Media optimize images≤2.5.3Update to 2.5.4
CVE-2026-18317—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'image_id' Parameter via ufg_save_gallery AJAX Action
Filter Gallery≤1.1.4Update to 1.1.5
CVE-2026-89138—
High8.1Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via 'ufg_gallery_id' Parameter
Filter Gallery≤1.1.4Update to 1.1.5
CVE-2026-89413—
Medium6.1Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters
EmbedPress≤4.6.5Update to 4.6.6
CVE-2026-89330—
Medium6.5Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter
Download Manager≤3.3.68Update to 3.3.69
CVE-2026-92714—
Medium5.35.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint
Divi5.0 – 5.11.1Update to 5.12.0
CVE-2026-91707—
Medium6.1Reflected Cross-Site Scripting via 'options' Parameter
Booking Calendar≤11.8.2Update to 11.8.3
CVE-2026-92561—
High7.2Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter
Booking Calendar≤11.8.2Update to 11.8.3
CVE-2026-92619—
High8.8Authenticated (Author+) PHP Object Injection via Nested JSON Post Content
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF≤6.5.5Update to 6.5.6
CVE-2026-17086—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg≤1.5.2No patch available
CVE-2026-15650—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg≤1.5.1Update to 1.5.2
CVE-2026-14855—
Medium4.3Cross-Site Request Forgery
Asset CleanUp: Page Speed Booster≤1.4.0.5Update to 1.4.0.6
CVE-2026-66571—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetBlog≤2.4.10Update to 2.4.10.1
CVE-2026-66572—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetTabs≤2.3.3.1Update to 2.3.3.2
CVE-2026-66573—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons≤8.8.3Update to 8.8.4
CVE-2026-66574—
Medium5.3Unauthenticated Insecure Direct Object Reference
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder≤51.1.81Update to 51.1.82
CVE-2026-66575—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetSearch≤3.6.3Update to 3.6.3.1
CVE-2026-66577—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetBlocks for Elementor≤1.5.2Update to 1.5.2.1
CVE-2026-66576—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Property Hive≤2.2.6Update to 2.3.0
CVE-2026-66578—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements≤2.9.2.1Update to 2.9.2.2
CVE-2026-66579—
Medium6.5Authenticated (Contributor+) SQL Injection
Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels≤7.12.0Update to 7.12.1
CVE-2026-66580—
Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
Unlimited Elements for Elementor≤2.0.19Update to 2.0.20
CVE-2026-66608—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Issues and Series for Newspapers, Magazines, Publishers, Writers≤3.1.3Update to 3.1.4
CVE-2026-66617—
Medium4.9Authenticated (Administrator+) SQL Injection
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings≤4.9.9Update to 5.0.0
CVE-2026-66618—
Medium4.9Authenticated (Administrator+) SQL Injection
Newsletters≤4.18Update to 4.18.1
CVE-2026-66619—
Medium4.9Authenticated (Administrator+) SQL Injection
WPMasterToolKit (WPMTK) – All in one plugin≤2.22.0Update to 2.23.1
CVE-2026-66624—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter
Brizy – Page Builder≤2.8.14Update to 2.8.15
CVE-2026-2585—

Search VulnCrest Radar

Jump to

Are you sure?