CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 1261)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.4 | Authenticated Stored Cross-Site Scripting | CVE-2021-24383 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2021-24372 | — | |
| Medium5.3 | Add Like/Dislike Bypass | CVE-2021-24379 | — | |
| High8.8 | Arbitrary File Upload to Remote Code Exectution | CVE-2021-4382 | — | |
| Medium6.1 | Newspaper Magazine News BuddyPress AMP < 5.4.4 - Reflected Cross-Site Scripting | CVE-2021-24364 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2021-24373 | — | |
| Critical9.8 | wpDiscuz 7.0 - 7.0.4 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution | CVE-2020-24186 | — | |
| Critical9.8 | 2.1.2 - Arbitrary Options Change | CVE-2021-4362 | — | |
| Critical9.8 | SQL Injection | CVE-2021-24361 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2021-24368 | — | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting | CVE-2021-24369 | — | |
| High8.8 | SQL Injection | CVE-2021-24520 | — | |
| Critical9.8 | Unauthenticated Arbitrary File Upload | CVE-2021-24370 | — | |
| Medium5.3 | Information Disclosure Jetpack – AI Agents & MCP, Security, Backup & Analytics<9.7.1Update to 2.0.8 or 2.1.6 or 2.2.9 or 2.3.9 or 2.4.6 or 2.5.4 or 2.6.5 or 2.7.4 or 2.8.4 or 2.9.5 or 3.0.5 or 3.1.4 or 3.2.4 or 3.3.5 or 3.4.5 or 3.5.5 or 3.6.3 or 3.7.4 or 3.8.4 or 3.9.8 or 4.0.5 or 4.1.2 or 4.2.3 or 4.3.3 or 4.4.3 or 4.5.1 or 4.6.1 or 4.7.2 or 4.8.3 or 4.9.1 or 5.0.1 or 5.1.2 or 5.2.3 or 5.3.2 or 5.4.2 or 5.5.3 or 5.6.3 or 5.7.3 or 5.8.2 or 5.9.2 or 6.0.2 or 6.1.3 or 6.2.3 or 6.3.5 or 6.4.4 or 6.5.2 or 6.6.3 or 6.7.2 or 6.8.3 or 6.9.2 or 7.0.3 or 7.1.3 or 7.2.3 or 7.3.3 or 7.4.3 or 7.5.5 or 7.6.2 or 7.7.4 or 7.8.2 or 7.9.2 or 8.0.1 or 8.1.2 or 8.2.4 or 8.3.1 or 8.4.3 or 8.5.1 or 8.6.2 or 8.7.2 or 8.8.3 or 8.9.2 or 9.0.3 or 9.1.1 or 9.2.2 or 9.3.3 or 9.4.2 or 9.5.3 or 9.6.2 or 9.7.1 | CVE-2021-24374 | — | |
| Medium5.4 | Admin Columns Free < 4.3 and Pro < 5.5.1 Stored Cross-Site Scripting | CVE-2021-24366 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2021-24357 | — | |
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2021-24367 | — | |
| Medium6.1 | Open Redirect | CVE-2021-24358 | — | |
| Medium6.5 | Authenticated SQL Injection | CVE-2021-24360 | — | |
| Medium5.3 | Open Redirect | CVE-2021-24359 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2021-24351 | — | |
| Medium6.6 | Authenticated PHAR Deserialization | CVE-2021-4451 | — | |
| Medium6.6 | Authenticated (Admin+) SQL Injection | CVE-2021-24345 | — | |
| Medium5.4 | Reflected Cross-Site Scripting | CVE-2021-24346 | — | |
| High7.2 | SQL Injection | CVE-2021-24348 | — | |
| High8.8 | SQL Injection | CVE-2021-24341 | — | |
| High8.8 | 2.0.3 - Authenticated Arbitrary Plugin Installation | CVE-2021-24354 | — | |
| High8.8 | 2.0.3 - Unauthenticated Redirect Export | CVE-2021-24352 | — | |
| High8.8 | 2.0.3 - Unauthenticated Redirect Import | CVE-2021-24353 | — | |
| Medium5.5 | Authenticated Stored Cross-Site Scripting via extra_data Parameter | CVE-2021-24424 | — |
- Medium5.4Authenticated Stored Cross-Site Scripting
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
<8.1.12Update to 8.1.12
- Medium6.1Reflected Cross-Site Scripting
WP Hardening (discontinued)
≤1.2.1Update to 1.2.2
- Medium5.3Add Like/Dislike Bypass
Comments Like Dislike
<1.1.4Update to 1.1.4
- High8.8Arbitrary File Upload to Remote Code Exectution
Recently
≤3.0.4Update to 3.0.5
- Medium6.1Newspaper Magazine News BuddyPress AMP < 5.4.4 - Reflected Cross-Site Scripting
Jannah - Newspaper Magazine News BuddyPress AMP
<5.4.4Update to 5.4.4
- Medium6.1Reflected Cross-Site Scripting
WP Hardening (discontinued)
<1.2.2Update to 1.2.2
- Critical9.8wpDiscuz 7.0 - 7.0.4 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution
Comments – wpDiscuz
7.0 – 7.0.4Update to 7.0.5
- Critical9.82.1.2 - Arbitrary Options Change
Social Sharing Plugin – Kiwi
2.1.0 – 2.1.2Update to 2.1.3
- Critical9.8SQL Injection
Location Manager
<2.1.0.10Update to 2.1.0.10
- Medium6.1Reflected Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤7.1.17Update to 7.1.18
- Medium5.4Authenticated Stored Cross-Site Scripting
Payment forms, Buy now buttons, and Invoicing System | GetPaid
≤2.3.3Update to 2.3.4
- High8.8SQL Injection
Stock in & out
≤1.0.4No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
Fancy Product Designer
<4.6.9Update to 4.6.9
- Medium5.3Information Disclosure
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<9.7.1Update to 2.0.8 or 2.1.6 or 2.2.9 or 2.3.9 or 2.4.6 or 2.5.4 or 2.6.5 or 2.7.4 or 2.8.4 or 2.9.5 or 3.0.5 or 3.1.4 or 3.2.4 or 3.3.5 or 3.4.5 or 3.5.5 or 3.6.3 or 3.7.4 or 3.8.4 or 3.9.8 or 4.0.5 or 4.1.2 or 4.2.3 or 4.3.3 or 4.4.3 or 4.5.1 or 4.6.1 or 4.7.2 or 4.8.3 or 4.9.1 or 5.0.1 or 5.1.2 or 5.2.3 or 5.3.2 or 5.4.2 or 5.5.3 or 5.6.3 or 5.7.3 or 5.8.2 or 5.9.2 or 6.0.2 or 6.1.3 or 6.2.3 or 6.3.5 or 6.4.4 or 6.5.2 or 6.6.3 or 6.7.2 or 6.8.3 or 6.9.2 or 7.0.3 or 7.1.3 or 7.2.3 or 7.3.3 or 7.4.3 or 7.5.5 or 7.6.2 or 7.7.4 or 7.8.2 or 7.9.2 or 8.0.1 or 8.1.2 or 8.2.4 or 8.3.1 or 8.4.3 or 8.5.1 or 8.6.2 or 8.7.2 or 8.8.3 or 8.9.2 or 9.0.3 or 9.1.1 or 9.2.2 or 9.3.3 or 9.4.2 or 9.5.3 or 9.6.2 or 9.7.1
- Medium5.4Admin Columns Free < 4.3 and Pro < 5.5.1 Stored Cross-Site Scripting
Admin Columns
≤4.2Update to 4.3
- Medium6.4Stored Cross-Site Scripting
FooGallery Photo Gallery : Image, Video & Masonry Galleries
<2.0.35Update to 2.0.35
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP Config File Editor
≤1.7.1No patch available
- Medium6.1Open Redirect
The Plus Addons for Elementor Page Builder Pro
<4.1.10Update to 4.1.10
- Medium6.5Authenticated SQL Injection
Yes/No Chart
<1.0.12Update to 1.0.12
- Medium5.3Open Redirect
The Plus Addons for Elementor Page Builder Pro
<4.1.11Update to 4.1.11
- Medium6.1Reflected Cross-Site Scripting
The Plus Addons for Elementor Page Builder Pro
<4.1.12Update to 4.1.12
- Medium6.6Authenticated PHAR Deserialization
NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall
<4.3.4Update to 4.3.4
- Medium6.6Authenticated (Admin+) SQL Injection
Sendit WP Newsletter
≤2.5.1No patch available
- Medium5.4Reflected Cross-Site Scripting
Stock in & out
≤1.0.4No patch available
- High7.2SQL Injection
Side Menu – add fixed side buttons
≤3.1.3Update to 3.1.5
- High8.8SQL Injection
Xllentech English Islamic Calendar
≤2.6.7Update to 2.6.8
- High8.82.0.3 - Authenticated Arbitrary Plugin Installation
Simple 301 Redirects by BetterLinks – Easy Redirect Manager
2.0.0 – 2.0.3Update to 2.0.4
- High8.82.0.3 - Unauthenticated Redirect Export
Simple 301 Redirects by BetterLinks – Easy Redirect Manager
2.0.0 – 2.0.3Update to 2.0.4
- High8.82.0.3 - Unauthenticated Redirect Import
Simple 301 Redirects by BetterLinks – Easy Redirect Manager
2.0.0 – 2.0.3Update to 2.0.4
- Medium5.5Authenticated Stored Cross-Site Scripting via extra_data Parameter
WP Reset
≤1.86Update to 1.90