CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 1243)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.54.0.2 - Authenticated SQL Injection via id Parameter
WP Bannerize
2.0.0 – 4.0.2No patch available
- Medium6.17.5.2.727 - Reflected Cross-Site Scripting via player_id Parameter
FV Flowplayer Video Player
7.5.0.727 – 7.5.2.727Update to 7.5.3.727
- Medium4.3Missing Authorization on jobsearch_update_job_import_schedule_call() function
JobSearch WP Job Board
≤1.8.1Update to 1.8.2
- High8.8Missing Authorization to Arbitrary Options Update
JobSearch WP Job Board
≤1.8.1Update to 1.8.2
- Medium6.1Reflected Cross-Site Scripting
Perfect Survey
≤1.5.2No patch available
- Critical9.8Unauthenticated SQL Injection
Perfect Survey
<1.5.2Update to 1.5.2
- Medium6.1Reflected Cross-Site Scripting
Simple Download Monitor
<3.9.5Update to 3.9.5
- Critical9.0Contributor+ Stored Cross-Site Scripting via File Thumbnail
Simple Download Monitor
≤3.9.4Update to 3.9.5
- Medium4.8Cross-Site Scripting
Booking.com Product Helper
<1.0.2Update to 1.0.2
- Medium5.3Full Path Disclosure
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
<17.3Update to 17.3
- Medium4.8Cross-Site Scripting
Booking.com Banner Creator
<1.4.3Update to 1.4.3
- Medium4.3Contributor+ Arbitrary Thumbnail Removal
Simple Download Monitor
<3.9.6Update to 3.9.6
- Medium5.3Sensitive Data Exposure
Simple Download Monitor
<3.9.6Update to 3.9.6
- Medium5.3Missing Authorization to Settings Change
JobSearch WP Job Board
≤1.8.1Update to 1.8.2
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Survey Plus
≤1.0No patch available
- High8.8Cross-Site Request Forgery
Perfect Survey
≤1.5.2No patch available
- Medium6.5Missing Authorization
Batch Cat
≤0.3No patch available
- Medium4.8Google Language Translator <= 6.0.11 - Admin+ Stored Cross-Site Scripting
Translate WordPress – Google Language Translator
<6.0.12Update to 6.0.12
- High7.2Unauthenticated Stored Cross-Site Scripting via IP
Perfect Survey
≤1.5.2No patch available
- High8.8Cross-Site Request Forgery
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
<1.9.9.41Update to 1.9.9.41
- Medium4.3Plugin's Settings Update via Cross-Site Request Forgery
Far Future Expiry Header
≤1.4Update to 1.5
- Medium5.5Admin+ Stored Cross-Site Scripting
Events Made Easy
<2.2.24Update to 2.2.24
- High8.8Accept Donations with PayPal <= 1.3.0 Cross-Site Request Forgery to Post Deletion
Accept Donations with PayPal & Stripe
<1.3.1Update to 1.3.1
- Medium5.5Multiple Admin+ Cross Site Scripting
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
≤2.4.1Update to 2.4.2
- High7.6Missing Authorization to Stored Cross-Site Scripting
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg
≤2.7.0Update to 2.7.1
- Medium6.1Reflected Cross-Site Scripting
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
<1.9.9.41Update to 1.9.9.41
- Medium6.5Settings Update
Logo Slider and Showcase
<1.3.37Update to 1.3.37
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Accept Donations with PayPal & Stripe
≤1.3Update to 1.3.1
- Medium4.3Insecure Direct Object Reference
Image Source Control Lite – Show Image Credits and Captions
<2.3.1Update to 2.3.1
- Medium5.5Admin+ Stored Cross-Site Scripting
Coming Soon, Under Construction & Maintenance Mode By Dazzler
≤1.6.3Update to 1.6.7