CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 125)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Information Exposure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.6Update to 4.4.7
- Medium5.3Unauthenticated Information Exposure
Ni WooCommerce Sales Report – Orders, Revenue & Sales Analytics Dashboard
≤4.1.0Update to 4.2.0
- High8.8Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX
Consulting - Business, Finance WordPress Theme
≤6.7.16Update to 6.7.17
- Medium4.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium5.4Unauthenticated Open Redirect
Newsletter
≤9.3.6Update to 9.3.7
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium4.3Authenticated (Board Member+) Comment Author Spoofing
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
≤2.0.14Update to 2.0.15
- Medium5.3Unauthenticated Insecure Direct Object Reference
kboard
≤6.6Update to 6.7
- Medium5.3Unauthenticated Information Exposure
Rox Appointment Booking – Event, Calendar & Appointment Scheduling
≤1.2.7Update to 1.2.8
- Medium5.3Unauthenticated Information Exposure
Subscriptions for WooCommerce
≤2.0.2Update to 2.0.3
- Medium5.3Missing Authorization
Rox Appointment Booking – Event, Calendar & Appointment Scheduling
<1.2.0Update to 1.2.0
- Medium4.3Authenticated (Subscriber+) Full Admin Area Denial of Service
Seraphinite Accelerator
≤2.29.23Update to 2.29.24
- Medium5.3Unauthenticated Appointment Slot Capacity Bypass
Appointment Hour Booking – Booking Calendar
≤1.5.94Update to 1.5.95
- Medium6.1Reflected Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.6Update to 4.4.7
- Medium5.3Unauthenticated Content Injection
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤6.34Update to 6.35
- Medium4.3Authenticated (Subscriber+) Information Exposure
Tutor LMS – eLearning and online course solution
≤4.0.7Update to 4.0.8
- High7.3Unauthenticated Privilege Escalation
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.8.0Update to 4.16.8.1
- Medium4.3Cross-Site Request Forgery
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.3Update to 4.4.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
≤4.2.11Update to 4.2.12
- High7.5Unauthenticated SQL Injection
Album Cover Finder
≤0.7.0No patch available
- Medium5.3Unauthenticated Information Exposure
Schema & Structured Data for WP & AMP
≤1.65Update to 1.66
- Critical9.8Unauthenticated Arbitrary File Upload
DS Ad Rotator
≤0.8No patch available
- Medium6.3Authenticated (Author+) Privilege Escalation
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
<5.2.8Update to 5.2.8
- Medium5.5Authenticated (Administrator+) Server-Side Request Forgery
WP Import Export Lite
≤3.9.32Update to 3.9.33
- Medium4.9Authenticated (Admin+) Path Traversal to Arbitrary Directory Deletion
WP Import Export Lite
≤3.9.32Update to 3.9.33
- High7.21.5.34 - Unauthenticated Stored Cross-Site Scripting
GenieWords
1.5.27 – 1.5.34No patch available
- Critical9.8Unauthenticated Remote Code Execution via Dynamic Render Field Type
Advanced Custom Fields: Extended PRO
≤0.9.2.6Update to 0.9.2.7
- Medium4.38.7.5 - Missing Authorization
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
8.7.2 – 8.7.5Update to 8.7.6
- Medium4.3Missing Authorization
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
≤2.0.14Update to 2.0.15