CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 1264)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.8Admin+ Stored Cross-Site Scripting
Smooth Page Scroll Up/Down Buttons
≤1.3Update to 1.4
- Medium5.3Arbitrary Options Update
Thrive Leads
<2.3.9.4Update to 2.3.9.4
- Medium6.1Reflected Cross-Site Scripting
Redirect 404 to parent
<1.3.1Update to 1.3.1
- Medium5.5Admin+ Stored Cross-Site Scripting
RSS for Yandex Turbo
≤1.30Update to 1.31
- Medium6.1Reflected Cross-Site Scripting
Select All Categories and Taxonomies, Change Checkbox to Radio Buttons
<1.3.2Update to 1.3.2
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Captchinoo, admin login page protection with Google recaptcha
≤2.3Update to 2.4
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Tree Sitemap (Pages, Posts & Categories list)
<2.9Update to 2.9
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
WP Content Copy Protection & No Right Click
<3.1.5Update to 3.1.5
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
WP Maintenance Mode & Site Under Construction
<1.8.2Update to 1.8.2
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Limit Login Attempts (Spam Protection)
<2.9Update to 2.9
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Login as User or Customer — User Switching
<1.8Update to 1.8
- High8.8Improper Authorization
WP Maintenance Mode & Site Under Construction
<1.5.2Update to 1.5.2
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Visitor Traffic Real Time Statistics
≤2.11Update to 2.12
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
WooCommerce
<5.2.0Update to 5.2.0
- Medium5.5Authenticated Stored Cross-Site Scripting
RSS for Yandex Turbo
≤1.29Update to 1.30
- Medium6.1Reflected Cross-Site Scripting
Accordions
<2.2.30Update to 2.2.30
- High7.5Unauthenticated Arbitrary Nonce Generation
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- High8.8Authenticated PHP Object Injection
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Medium6.5Authenticated Arbitrary Plugin Installation
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Critical9.8Arbitrary File Upload
Kaswara Modern VC Addons
≤3.0.1No patch available
- Medium4.3Authenticated Arbitrary Post Deletion
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Medium6.3Unprotected AJAX Actions
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Medium6.1Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.68Update to 1.5.69
- Medium6.1Multiple Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.69Update to 1.5.69
- Medium6.1Reflected Cross-Site Scripting <= 1.5.68 - Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.68Update to 1.5.69
- Medium6.1Reflected Cross-Site scripting
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.7.14Update to 1.7.15
- Medium6.1Reflected Cross-Site scripting
Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key
≤1.2.4Update to 1.2.5
- Medium6.1Reflected Cross-Site Scripting
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
≤1.10.4Update to 1.10.5
- High8.8Cross-Site Request Forgery
404 SEO Redirection
≤1.3Update to 1.4
- Medium6.1Reflected Cross-Site Scripting via tab Parameter
All 404 Redirect to Homepage
<1.21Update to 1.21