CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 1241)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Stored Cross-Site Scripting
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
≤15.3Update to 15.4
- Medium5.4Author+ Stored Cross-Site Scripting via Preview Module
YOP Poll
≤6.3.0Update to 6.3.1
- Medium5.4Author+ Stored Cross-Site Scripting via Options Module
YOP Poll
≤6.3.0Update to 6.3.1
- Medium5.5Stored Cross-Site Scripting
WpGenius Job Listing
≤1.0.2Update to 1.0.3
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Job Board Vanila Plugin
1.0 – 1.0No patch available
- Medium5.5Stored Cross-Site Scripting
WordPress ERP, HR, CRM, and Project Management Plugin – Business Manager
≤1.4.5Update to 1.4.6
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
MyBB Cross-Poster
≤1.0No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
job-portal
≤0.0.1No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
KJM Admin Notices
≤2.0.1No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Job Manager
≤0.7.25No patch available
- Medium5.5HAL <= 2.1.1 Authenticated Stored Cross-Site Scripting
HAL
≤2.1.1Update to 2.2
- High8.8Authenticated (Subscriber+) SQL Injection
WP Fastest Cache – WordPress Cache Plugin
<0.9.5Update to 0.9.5
- Medium5.5Authenticated Stored Cross-Site Scripting
Author Bio Box
≤3.3.1Update to 3.3.2
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Fastest Cache – WordPress Cache Plugin
<0.9.5Update to 0.9.5
- High8.8Authenticated File Upload and Path Traversal
Brizy – Page Builder
≤2.3.11Update to 2.3.12
- High7.5Insecure Password Creation
Simple JWT Login – Allows you to use JWT on REST endpoints.
<3.3.0Update to 3.3.0
- High8.8Authenticated (Admin+) SQL Injection
WP Cloudy, weather plugin
≤4.4.9No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Testimonial – WordPress Testimonial Showcase Plugin Grid Plus Testimonial Slider
<1.6.0Update to 1.6.0
- Medium6.4Page Builder <= 2.3.11 - Stored Cross-Site Scripting
Brizy – Page Builder
≤2.3.11Update to 2.3.12
- Medium4.3Cross-Site Request Forgery
Colorful Categories
<2.0.15Update to 2.0.15
- High8.8Backdoored
Frontend Post WordPress Plugin – AccessPress Anonymous Post
2.8.0 – 2.8.0Update to 2.8.1
- Medium5.4Authenticated Stored Cross-Site Scripting
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
≤2.4.13Update to 2.4.14
- High7.2Admin+ Arbitrary PHP Code Execution
Similar Posts – Best Related Posts Plugin for WordPress
≤3.1.5Update to 3.1.6
- Medium6.5Logs Deletion via Cross-Site Request Forgery
404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring
<3.0.9Update to 3.0.9
- Medium4.3Contributor+ Arbitrary Post Schedule Deletion
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
≤2.5.1Update to 2.6.0
- Critical9.8Unauthenticated SQL Injection
Pie Register – User Registration, Profiles & Content Restriction
<3.7.1.6Update to 3.7.1.6
- Medium4.3wpDiscuz <= 7.3.3 - Arbitrary Comment Addition/Edition/Deletion by Cross-Site Request Forgery
Comments – wpDiscuz
<7.3.4Update to 7.3.4
- Critical9.8Authentication Bypass
Pie Register – User Registration, Profiles & Content Restriction
≤3.7.1.4Update to 3.7.1.5
- High8.8SQL Injection
MAZ Loader – Preloader Builder for WordPress
<1.3.3Update to 1.3.3
- Medium6.1Reflected Cross-Site Scripting
WP Header Images
<2.0.1Update to 2.0.1