CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 1263)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.8Authenticated Stored Cross-Site Scripting via Gallery Title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.67Update to 1.5.67
- Medium5.4Stored Cross-Site Scripting
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
<4.21.1Update to 4.21.1
- High7.2Stored Cross-Site Scripting
ReDi Restaurant Reservation – Instant Restaurant Booking & Table Reservation System
≤21.0307Update to 21.0426
- High8.8Authenticated Code Injection
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
<4.1.0.2Update to 4.1.0.2
- Medium6.1Reflected Cross-Site Scripting
Simple Giveaways – Grow your business, email lists and traffic with contests
<2.36.1Update to 2.36.2
- Medium4.8Stored Cross-Site Scripting
UpdraftPlus Premium
<1.6.59Update to 1.6.59
- High7.3Missing Authorization
Product Filter for WooCommerce by WBW
≤1.4.9Update to 1.5.0
- Medium5.5Stored Cross-Site Scripting
Autoptimize
<2.8.4Update to 2.8.4
- Medium6.1Unauthenticated Stored Cross-Site Scripting
DSGVO All in one for WP
≤3.9Update to 4.0
- Medium6.1Reflected Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.1.20Update to 2.1.20
- Medium6.4Authenticated Stored Cross-Site Scripting
Hana Flv Player
≤3.1.3No patch available
- Medium6.1Reflected Cross-Site Scripting
Product Slider, Product Grid, Product Masonry
≤1.13.21Update to 1.13.22
- Medium6.3Missing Authorization
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤4.6.4Update to 4.6.5
- High8.8Authenticated (Contributor+) Privilege Escalation
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤4.6.4Update to 4.6.5
- Medium6.1Stored Cross-Site Scripting
Watcheezy Live chat plugin for WordPress
≤2.0Update to 3.0
- Medium4.8Authenticated Stored Cross-Site Scripting
WP Customer Reviews
≤3.5.5Update to 3.5.6
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Hotjar Connecticator
≤1.1.1No patch available
- Medium6.1Tour & Travel WordPress Theme < 2.1 - Reflected Cross-Site Scripting
Goto - Tour & Travel WordPress Theme
<2.1Update to 2.1
- Low3.8Authenticated (Admin+) Cross-Site Scripting
WP YouTube Lyte
<1.7.16Update to 1.7.16
- Medium4.8Authenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
<2.10.4Update to 2.10.4
- Critical10.0Remote Code Execution
Social Sharing Plugin – Social Warfare
<3.5.3Update to 3.5.3
- Medium6.1Open Redirect
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
<7.5.0Update to 7.5.0
- Medium5.3Denial of Service
WPGraphQL
≤1.3.5Update to 1.3.6
- Medium6.5Authenticated (Admin+) Directory Traversal to Arbitrary File Deletion
WP Fastest Cache – WordPress Cache Plugin
<0.9.1.7Update to 0.9.1.7
- Critical9.8Auto Classifieds Script <= 2.1.0 - Unauthenticated SQL Injection
Car Seller – Auto Classifieds Script
≤2.1.0No patch available
- High8.8Authenticated Privilege Escalation
Store Locator Plus® for WordPress
≤5.5.15Update to 5.7
- Critical9.8Tour & Travel WordPress Theme < 2.1 - SQL Injection
Goto - Tour & Travel WordPress Theme
<2.1Update to 2.1
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Store Locator Plus® for WordPress
≤5.12.3Update to 5.13.8
- Medium6.4Stored Cross-Site Scripting
Happy Addons for Elementor Pro
<1.17.0Update to 1.17.0
- Medium4.8Cross-Site Scripting
Smooth Page Scroll Up/Down Buttons
≤1.3Update to 1.4