VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-434Vulnerability type

WordPress Arbitrary File Upload vulnerabilities (page 1255)

Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.

Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Arbitrary File Upload vulnerabilities (page 1255)
SeverityVulnerabilityCVEInstallsPublished
High7.2Authenticated (Admin+) SQL Injection
M-vSlider≤2.1.3No patch available
CVE-2021-24557—
High7.2Authenticated (Admin+) SQL Injection
Paytm – Donation Plugin≤1.3.2No patch available
CVE-2021-24554—
Critical9.8Unauthenticated SQL Injection
Edit Comments≤0.3No patch available
CVE-2021-24551—
High7.2Authenticated SQL Injection
Simple Events Calendar≤1.4.0Update to 1.4.1
CVE-2021-24552—
Medium5.8Reflected Cross-Site Scripting
Translate WordPress with GTranslate<2.8.65Update to 2.8.65
CVE-2021-34630—
High7.2Authenticated (Admin+) SQL Injection
WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件≤3.7.2No patch available
CVE-2021-24390—
High7.2Authenticated (Admin+) SQL Injection
Easy Testimonial Manager≤1.2.0No patch available
CVE-2021-24394—
Medium6.4Stored Cross-Site Scripting
Simple Post≤1.1No patch available
CVE-2021-24567—
High7.2Authenticated (Admin+) SQL Injection
Comment Highlighter≤0.13No patch available
CVE-2021-24393—
High8.8Authenticated (Admin+) SQL Injection
Cashtomer≤1.0.0No patch available
CVE-2021-24391—
High7.2Authenticated (Admin+) SQL Injection
WordPress Membership SwiftCloud.io≤1.0No patch available
CVE-2021-24392—
High7.2Authenticated (Admin+) SQL Injection
Embed Youtube Video≤1.0No patch available
CVE-2021-24395—
High8.8Authenticated (Subscriber+) SQL Injection
Diary & Availability Calendar≤1.0.3No patch available
CVE-2021-24555—
High8.8Authenticated Local File Inclusion
FOX – Currency Switcher Professional for WooCommerce≤1.3.7Update to 1.3.7.1
CVE-2021-24566—
Medium4.3Authorization Bypass
SendGrid≤1.11.8No patch available
CVE-2021-34629—
Medium6.4Authenticated Stored Cross-Site Scripting
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)≤1.6.50Update to 1.6.51
CVE-2021-24531—
High7.1Reflected Cross-Site Scripting
Translate WordPress – Google Language Translator<6.0.10Update to 6.0.10
CVE-2021-4452—
Medium4.8Authenticated Stored Cross-Site Scripting
Maintenance<4.03Update to 4.03
CVE-2021-24533—
Medium5.4Stored Cross-Site Scripting
Grid Gallery – for Photo Gallery, Image Gallery & Portfolio<1.2.5Update to 1.2.5
CVE-2021-24529—
High8.8NewsPlugin <= 1.0.18 – Cross-Site Request Forgery to Stored Cross-Site Scripting
NewsPlugin≤1.0.18Update to 1.1.0
CVE-2021-34631—
High8.8Privilege Escalation via Arbitrary Role Change
HM Multiple Roles≤1.2Update to 1.3
CVE-2021-24602—
Medium5.4Stored Cross-Site Scripting
KN Fix Your Title≤1.0.1No patch available
CVE-2021-24547—
High7.2Authenticated (Admin+) SQL Injection
Giveaway≤1.2.2No patch available
CVE-2021-24497—
Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Social Tape≤1.0No patch available
CVE-2021-24411—
Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
My Site Audit≤1.2.4Update to 1.2.5
CVE-2021-24445—
High8.8SQL Injection
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses≤3.2.6.7Update to 3.2.6.8
CVE-2020-6010—
Medium6.4Contributor+ Stored Cross-Site Scripting
Wonder PDF Embed≤1.6Update to 1.7
CVE-2021-24541—
Medium6.4Contributor+ Stored Cross-Site Scripting
Embeds for YouTube≤5.2.1Update to 5.2.2
CVE-2021-24471—
Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Mimetic Books≤0.2.13No patch available
CVE-2021-24548—
Critical9.8Admin Access via Password Reset
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor<3.4.9Update to 3.4.9
CVE-2021-24527—

Search VulnCrest Radar

Jump to

Are you sure?