VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-434Vulnerability type

WordPress Arbitrary File Upload vulnerabilities (page 1259)

Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.

Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Arbitrary File Upload vulnerabilities (page 1259)
SeverityVulnerabilityCVEInstallsPublished
Critical9.8Server-Side Request Forgery & Remote File Inclusion
Onair2: Radio Station WordPress Theme With Non-Stop Music Player<3.9.9.2Update to 3.9.9.2
CVE-2021-24472—
Medium5.5Authenticated Stored Cross-Site Scripting
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content<3.1.8Update to 3.1.8
CVE-2021-24450—
Medium6.1Reflected Cross-site Scripting via id Parameter
Awesome Weather Widget≤3.0.2No patch available
CVE-2021-24474—
Medium6.1Reflected Cross-Site Scripting
Post Grid≤2.1.7Update to 2.1.8
CVE-2021-24488—
Medium4.3Authenticated Insecure Direct Object Reference
User Profile Picture – Custom Local Avatars<2.6.0Update to 2.6.0
CVE-2021-24473—
Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Any Hostname≤1.0.6No patch available
CVE-2021-24481—
High7.2Reflected Cross-Site Scripting via extension
W3 Total Cache0.5 – 2.1.4Update to 2.1.5
CVE-2021-24452—
Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
DrawBlog≤0.90No patch available
CVE-2021-24479—
Medium6.1Reflected Cross-Site Scripting
event-espresso-core≤4.10.6.pUpdate to 4.10.7.p
CVE-2020-26153—
Critical9.8Unauthenticated Arbitrary File Upload
ZoomSounds - WordPress Wave Audio Player with Playlist≤5.96Update to 6.05
CVE-2021-4449—
Medium6.4Authenticated Cross-Site Scripting
WP Popular Posts<5.3.3Update to 5.3.3
CVE-2021-20746—
Medium5.3Local File Inclusion
WP Image Zoom≤1.46Update to 1.47.1
CVE-2021-24447—
Critical9.8Unauthenticated Blind SQL Injection
Poll, Survey, Questionnaire and Voting system<1.5.3Update to 1.5.3
CVE-2021-24442—
Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
CiviCRM for WordPress≤5.28.0Update to 5.28.1
CVE-2020-36389—
High7.1Cross-Site Scripting
Fudousan Plugin≤5.7.0No patch available
CVE-2021-20749—
Medium6.1Reflected Cross-Site Scripting
Prismatic≤2.7Update to 2.8
CVE-2021-24409—
Medium4.8Authenticated Stored Cross-Site Scripting
My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu)<2.5.2Update to 2.5.2
CVE-2021-24425—
Medium4.3Cross-Site Request Forgery Bypass
Remove Schema≤1.5Update to 1.6
CVE-2021-4403—
Medium4.3Cross-Site Request Forgery Bypass
Staff Directory Plugin: Company Directory≤3.6Update to 4.0
CVE-2021-4397—
High7.2Authenticated (Admin+) SQL Injection
Export Users With Meta<0.6.5Update to 0.6.5
CVE-2021-24451—
Medium5.4Admin Columns Free < 4.3.2 and Pro < 5.5.2 Authenticated Stored Cross-Site Scripting
Admin Columns<4.3.2Update to 4.3.2
CVE-2021-24365—
Medium4.3Cross-Site Request Forgery Bypass
Absolute Reviews≤1.0.8Update to 1.0.9
CVE-2021-4426—
Medium5.4Stored Cross-Site Scripting
Prismatic≤2.7Update to 2.8
CVE-2021-24408—
Medium4.8Stored Cross-Site Scripting
Sign-up Sheets<1.0.14Update to 1.0.14
CVE-2021-24440—
Medium4.3Cross-Site Request Forgery Bypass
DW Question & Answer≤1.5.8No patch available
CVE-2021-4408—
Medium5.4Stored Cross-Site Scripting
Browser Screenshots<1.7.6Update to 1.7.6
CVE-2021-24439—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
simple sort&search≤0.0.3No patch available
CVE-2021-24433—
Medium4.3Cross-Site Request Forgery Bypass
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers≤2.8.28Update to 2.8.29
CVE-2021-4415—
Medium4.3Cross-Site Request Forgery Bypass
wp-mpdf≤3.5.1Update to 3.5.2
CVE-2021-4416—
Medium6.1Stored Cross-Site Scripting
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas<6.3.1Update to 6.3.1
CVE-2021-24429—

Search VulnCrest Radar

Jump to

Are you sure?