CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 1253)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1WP Fusion Lite <= 3.37.18 – Cross-Site Request Forgery to Data Deletion
WP Fusion Lite – Marketing Automation and CRM Integration for WordPress
≤3.37.18Update to 3.37.30
- High8.8Authenticated SQL Injection
WP Simple Booking Calendar
≤2.0.6Update to 2.0.7
- High8.8Authenticated SQL Injection
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
<6.60Update to 6.60
- Medium6.1Cross-Site Scripting
ReFlex Gallery » WordPress Photo Gallery
<1.4.3Update to 1.4.3
- Medium6.1WP Fusion Lite <= 3.37.18 – Reflected Cross-Site Scripting
WP Fusion Lite – Marketing Automation and CRM Integration for WordPress
≤3.37.18Update to 3.37.30
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Highlight Sitewide Notice, Text, Button Menu
<0.9.3Update to 0.9.3
- Medium5.4Authenticated Stored Cross-Site Scripting
Free Cookie Notice & Consent Banner for Privacy Compliance (GDPR, CCPA, DSGVO and others)
<1.7.2Update to 1.7.2
- High8.8SQL Injection
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤2.4.1Update to 2.4.2
- High7.5Missing Capabilities Check to Information Disclosure
Welcart e-Commerce
<2.2.8Update to 2.2.8
- Medium4.3Missing Capabilities Check to Information Disclosure
Welcart e-Commerce
<2.2.8Update to 2.2.8
- Medium5.5Stored Cross-Site Scripting
WP Mapa Politico España
<3.7.0Update to 3.7.0
- High8.8SQL Injection
Availability Calendar
<1.2.1Update to 1.2.1
- Medium5.5Stored Cross-Site Scripting
Availability Calendar
≤1.2.1Update to 1.2.2
- Medium6.4Authenticated Stored Cross-Site Scripting
Business Hours Indicator
<2.3.5Update to 2.3.5
- Medium6.1Reflected Cross-Site Scripting via ga_action parameter
ShareThis Dashboard for Google Analytics
<2.5.2Update to 2.5.2
- Medium6.1Reflected Cross Site Scripting
Email Encoder – Protect Email Addresses and Phone Numbers
≤2.1.1Update to 2.1.2
- Medium5.5Authenticated Stored Cross-Site Scripting
Sitewide Notice WP
<2.3Update to 2.3
- High7.5PHP Object Injection
Bold Page Builder
≤3.1.5Update to 3.1.6
- Medium6.1Cross-Site Scripting
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
<3.4.7Update to 3.4.7
- High8.8Cross-Site Request Forgery
Youtube Feeder
≤2.0.1No patch available
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
WP Dialog
≤1.2.5.5No patch available
- High8.8Nifty Newsletters <= 4.0.23 – Cross-Site Request Forgery to Stored Cross-Site Scripting
Nifty Newsletters (Formerly Sola Newsletters)
≤4.0.23No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting
有赏 You Shang
≤1.0.1No patch available
- Medium5.5Stored Cross-Site Scripting
youForms for WordPress – Creating Forms for CopeCart
≤1.0.5Update to 1.0.6
- High8.8SQL Injection
ZhuiGe Official Website Mini Program
<1.1.1Update to 1.1.1
- Medium6.5Cross-Site Scripting
Download Manager
≤3.1.24Update to 3.1.25
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Alojapro Booking Engine
≤1.1.15Update to 1.1.16
- High7.5Authenticated File Upload
Download Manager
≤3.1.24Update to 3.1.25
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
FluentSMTP – WP Mail SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP
<2.0.1Update to 2.0.1
- Medium5.5Stored Cross-Site Scripting
Splash Header
<1.20.8Update to 1.20.8