VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-434Vulnerability type

WordPress Arbitrary File Upload vulnerabilities (page 1260)

Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.

Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Arbitrary File Upload vulnerabilities (page 1260)
SeverityVulnerabilityCVEInstallsPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
simple sort&search≤0.0.3No patch available
CVE-2021-24433—
High7.2Authenticated (Admin+) SQL Injection
Export Users With Meta<0.6.5Update to 0.6.5
CVE-2021-24451—
Medium5.4Stored Cross-Site Scripting
Browser Screenshots<1.7.6Update to 1.7.6
CVE-2021-24439—
Medium4.3Cross-Site Request Forgery Bypass
Remove Schema≤1.5Update to 1.6
CVE-2021-4403—
Medium6.4Missing Authorization to Redirect Creation
404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring≤3.0.7Update to 3.0.8
CVE-2021-4338—
Medium6.1Unauthenticated Stored Cross-Site Scripting
YOP Poll≤6.2.7Update to 6.2.8
CVE-2021-24454—
Critical9.8Unauthenticated SQL Injection
FileBird – WordPress Media Library Folders & File Manager4.7.3 – 4.7.3Update to 4.7.4
CVE-2021-24385—
Medium5.4Authenticated Stored Cross-Site Scripting
Request a Quote – Quote Forms for Any WordPress Site<2.3.4Update to 2.3.4
CVE-2021-24420—
High8.8Stored Cross-Site Scripting
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder<3.6.67Update to 3.6.67
CVE-2021-34620—
Medium4.8W3 Total Cache <= 2.1.2 Authenticated (Admin+) Stored Cross-Site Scripting
W3 Total Cache<2.1.3Update to 2.1.3
CVE-2021-24427—
Medium6.1Reflected Cross-Site Scripting
Backup by 10Web – Backup and Restore Plugin≤1.0.20No patch available
CVE-2021-24426—
Medium6.4Authenticated (author+) Stored Cross-Site Scripting via SVG
WP SVG Images≤3.3Update to 3.4
CVE-2021-24386—
Medium6.1Open Redirect
wpForo Forum≤1.9.6Update to 1.9.7
CVE-2021-24406—
High8.8Cross-Site Request Forgery to Arbitrary File Upload
Stock Manager for WooCommerce≤2.5.7Update to 2.6.0
CVE-2021-34619—
Medium6.1Reflected Cross-Site Scripting
Jannah - Newspaper Magazine News BuddyPress AMP<5.4.5Update to 5.4.5
CVE-2021-24407—
Medium6.1Reflected Cross-Site Scripting
WP Foodbakery≤2.1Update to 2.2
CVE-2021-24389—
Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
VikRentCar Car Rental Management System≤1.1.6Update to 1.1.7
CVE-2021-24388—
High7.5Authentication Bypass for PDF Reports
nex-forms≤7.8.7Update to 7.8.8
CVE-2021-34675—
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Easy Cookies Policy≤1.6.2No patch available
CVE-2021-24405—
Medium6.1Reflected Cross-Site Scripting
Welcart e-Commerce≤2.2.3Update to 2.2.4
CVE-2021-20734—
Medium6.1Reflected Cross-Site Scripting
Real Estate 7 WordPress<3.1.1Update to 3.1.1
CVE-2021-24387—
Medium6.1Reflected Cross-Site Scripting
Advanced AJAX Product Filters≤1.5.4.6Update to 1.5.4.7
CVE-2021-24432—
Critical9.8Local File Inclusion
Motor – Cars, Parts, Service, Equipments and Accessories WooCommerce Store<3.1.0Update to 3.1.0
CVE-2021-24375—
Medium4.3Cross-Site Request Forgery Bypass
Custom css-js-php≤2.0.7No patch available
CVE-2021-4418—
Critical9.8Object Injection
JoomSport – for Sports: Team & League, Football, Hockey & more<5.1.8Update to 5.1.8
CVE-2021-24384—
High8.8Authenticated Remote Command Execution
Form Manager<1.7.3Update to 1.7.3
CVE-2015-7806—
Medium4.3Cross-Site Request Forgery Bypass
WP Prayer≤1.6.5Update to 1.6.6
CVE-2021-4412—
Medium4.3Cross-Site Request Forgery Bypass
Qtranslate Slug≤1.1.18No patch available
CVE-2021-4410—
Medium4.3Multiple Roles <= 1.3.1- Cross-Site Request Forgery Bypass
Multiple Roles≤1.3.1Update to 1.3.2
CVE-2021-4402—
Medium5.4Authenticated Stored Cross-Site Scripting
Smart Slider 3<3.5.0.9Update to 3.5.0.9
CVE-2021-24382—

Search VulnCrest Radar

Jump to

Are you sure?