VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-434Vulnerability type

WordPress Arbitrary File Upload vulnerabilities (page 1242)

Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.

Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Arbitrary File Upload vulnerabilities (page 1242)
SeverityVulnerabilityCVEInstallsPublished
Medium5.5Stored Cross-Site Scripting
Qwizcards | online quizzes and flashcards≤3.61Update to 3.62
CVE-2021-24706—
Medium6.5Authenticated PHP Code Injection
Loco Translate<2.5.4Update to 2.5.4
CVE-2021-24721—
High8.8Cross-Site Request Forgery
WP SEO Redirect 301<2.3.2Update to 2.3.2
CVE-2021-24832—
Medium4.8Stored Cross-Site Scripting
School Management System – WPSchoolPress<2.1.17Update to 2.1.17
CVE-2021-24664—
High8.8Frontend Manager for WooCommerce <= 6.5.11 - Customer/Subscriber+ SQL Injection
WCFM – Frontend Manager for WooCommerce≤6.5.11Update to 6.5.12
CVE-2021-24835—
High8.8SQL Injection
School Management System – WPSchoolPress<2.1.10Update to 2.1.10
CVE-2021-24575—
Medium4.8Admin+ Stored Cross-Site Scripting
Print-O-Matic≤2.0.2Update to 2.0.3
CVE-2021-24710—
Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Quiz Tool Lite≤2.3.15No patch available
CVE-2021-24701—
Medium6.1Reflected Cross-Site Scripting
WP Header Images<2.0.1Update to 2.0.1
CVE-2021-24798—
High8.8SQL Injection
MAZ Loader – Preloader Builder for WordPress<1.3.3Update to 1.3.3
CVE-2021-24669—
Critical9.8Authentication Bypass
Pie Register – User Registration, Profiles & Content Restriction≤3.7.1.4Update to 3.7.1.5
CVE-2025-34077—
Critical9.8Unauthenticated SQL Injection
Asgaros Forum≤1.15.12Update to 1.15.13
CVE-2021-24827—
High7.2Authenticated SQL Injections
Header Footer Code Manager<1.1.14Update to 1.1.14
CVE-2021-24791—
High8.1Authentication Bypass
Pie Register – User Registration, Profiles & Content Restriction<3.7.1.6Update to 3.7.1.6
CVE-2021-24647—
Medium5.5Authenticated (Editor+) Stored Cross-Site Scripting
Comment Engine Pro≤1.0No patch available
CVE-2021-36911—
Medium6.4Agent+ Stored Cross-Site Scripting
Support Board≤3.3.4Update to 3.3.5
CVE-2021-24807—
High8.8Cross-Site Request Forgery
Chameleon CSS≤1.2No patch available
CVE-2021-24626—
High7.2Authenticated (Admin+) SQL Injection
Post Content XMLRPC≤1.0No patch available
CVE-2021-24629—
High7.2Authenticated (Admin+) SQL Injection
G Auto-Hyperlink≤1.0.1No patch available
CVE-2021-24627—
High7.2Authenticated (Admin+) SQL Injection
SpiderCatalog≤1.7.3No patch available
CVE-2021-24625—
High7.2Authenticated (Admin+) SQL Injection
Wow Forms – create any form with custom style≤3.1.3No patch available
CVE-2021-24628—
High7.2Authenticated (Admin+) SQL Injection
Unlimited PopUps≤4.5.3No patch available
CVE-2021-24631—
High8.8Authenticated (Author+) SQL Injection
Schreikasten≤0.14.18No patch available
CVE-2021-24630—
High8.8Authenticated (Subscriber+) Arbitrary File Upload
Arrival≤1.4.2Update to 1.4.3
CVE-2021-39317—
Medium4.3Log Deletion via Cross-Site Request Forgery
Redirect 404 Error Page to Homepage or Custom Page with Logs≤1.7.8Update to 1.7.9
CVE-2021-24767—
Medium4.8Admin+ Stored Cross-Site Scripting
WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel<1.3.1Update to 1.3.1
CVE-2021-24708—
High8.8Subscriber+ SQL Injection
Visitor Traffic Real Time Statistics≤3.8Update to 3.9
CVE-2021-24829—
Medium4.3Cross-Site Request Forgery
Genie WP Favicon≤0.5.2No patch available
CVE-2021-24674—
Medium4.8Admin+ Stored Cross-Site Scripting
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder<5.0.07Update to 5.0.07
CVE-2021-24608—
Medium4.3Author Arbitrary Media File Renaming
Phoenix Media Rename≤3.4.2Update to 3.4.4
CVE-2021-24816—

Search VulnCrest Radar

Jump to

Are you sure?