CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 1273)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.4 | Arbitrary File Deletion WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28039 | — | |
| High8.8 | Privilege Escalation via XML-RPC WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28035 | — | |
| Medium4.3 | Spam Embed on Multisite Installations WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28033 | — | |
| Critical9.8 | PHP Object Injection Gadget WordPress<5.5.3Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.8 or 5.2.9 or 5.3.6 or 5.4.4 or 5.5.3 | CVE-2021-29476 | — | |
| High8.8 | Deserialization Gadget WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28032 | — | |
| Medium6.1 | Reflected Cross-Site Scripting via Global Variables WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28034 | — | |
| High8.8 | Privilege Escalation via XML-RPC WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28036 | — | |
| Medium6.4 | Stored Cross-Site Scripting via post slugs WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28038 | — | |
| Medium4.3 | Cross-Site Request Forgery to Theme Image Change WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28040 | — | |
| Medium4.8 | Misconfiguration That Allows Trigger of New Installation WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28037 | — | |
| Medium5.5 | Authenticated Stored Cross-Site Scripting | CVE-2020-27344 | — | |
| High8.8 | SQL Injection | CVE-2020-5651 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2020-5650 | — | |
| Critical9.8 | SQL Injection | CVE-2020-27615 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2020-27356 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2020-28707 | — | |
| High8.8 | Arbitrary Options Update | CVE-2020-36725 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2020-5642 | — | |
| High8.8 | Cross-Site Request Forgery to Arbitrary File Modification and Creation | CVE-2020-28649 | — | |
| High7.1 | Incorrect Authorization Checks Allowing Post Modification | CVE-2021-38345 | — | |
| High7.2 | Arbitrary File Upload | CVE-2021-24123 | — | |
| High8.1 | Race Condition leading to Remote Code Execution | CVE-2021-24377 | — | |
| Medium4.8 | Unsafe File Upload to Cross-Site Scripting | CVE-2021-24378 | — | |
| Critical9.8 | Arbitrary File Upload (and Remote Code Execution) via Import Settings | CVE-2021-24376 | — | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting | CVE-2020-28650 | — | |
| High7.2 | Authenticated Remote Code Execution in Dynamic OOO Widget | CVE-2020-26596 | — | |
| Critical9.1 | Authentication Bypass | CVE-2020-26511 | — | |
| Critical9.8 | Function Injection | CVE-2020-36708 | — | |
| Medium6.5 | Unauthenticated Plugin Activation/Deactivation | CVE-2020-36721 | — | |
| High8.8 | SQL Injection | CVE-2021-24132 | — |
- Medium5.4Arbitrary File Deletion
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- High8.8Privilege Escalation via XML-RPC
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- Medium4.3Spam Embed on Multisite Installations
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- Critical9.8PHP Object Injection Gadget
WordPress
<5.5.3Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.8 or 5.2.9 or 5.3.6 or 5.4.4 or 5.5.3
- High8.8Deserialization Gadget
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- Medium6.1Reflected Cross-Site Scripting via Global Variables
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- High8.8Privilege Escalation via XML-RPC
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- Medium6.4Stored Cross-Site Scripting via post slugs
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- Medium4.3Cross-Site Request Forgery to Theme Image Change
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- Medium4.8Misconfiguration That Allows Trigger of New Installation
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- Medium5.5Authenticated Stored Cross-Site Scripting
CM Download Manager – Organize, Protect & Share Files in WordPress
<2.8.0Update to 2.8.0
- High8.8SQL Injection
Simple Download Monitor
≤3.8.8Update to 3.8.9
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Simple Download Monitor
≤3.3.8Update to 3.3.9
- Critical9.8SQL Injection
Loginizer
<1.6.4Update to 1.6.4
- Medium5.4Stored Cross-Site Scripting
Debug Meta Data
≤1.1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Stockdio Historical Chart
<2.8.1Update to 2.8.1
- High8.8Arbitrary Options Update
TI WooCommerce Wishlist
≤1.21.11Update to 1.21.12
- High8.8Cross-Site Request Forgery
AI Chatbot for WooCommerce & Live Chat – onWebChat
≤3.1.0Update to 3.2.0
- High8.8Cross-Site Request Forgery to Arbitrary File Modification and Creation
Child Theme Creator by Orbisius
<1.5.2Update to 1.5.2
- High7.1Incorrect Authorization Checks Allowing Post Modification
Brizy – Page Builder
≤2.3.11Update to 1.0.126 or 2.3.12
- High7.2Arbitrary File Upload
PowerPress Podcasting plugin by Blubrry
≤8.3.7Update to 8.3.8
- High8.1Race Condition leading to Remote Code Execution
Autoptimize
<2.7.8Update to 2.7.8
- Medium4.8Unsafe File Upload to Cross-Site Scripting
Autoptimize
<2.7.8Update to 2.7.8
- Critical9.8Arbitrary File Upload (and Remote Code Execution) via Import Settings
Autoptimize
<2.7.8Update to 2.7.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPBakery Page Builder
≤6.4Update to 6.4.1
- High7.2Authenticated Remote Code Execution in Dynamic OOO Widget
Elementor Website Builder Pro
≤3.0.5Update to 3.0.6
- Critical9.1Authentication Bypass
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
≤11.6Update to 11.7
- Critical9.8Function Injection
Sparkling
≤2.4.8Update to 2.4.9
- Medium6.5Unauthenticated Plugin Activation/Deactivation
Newspaper X
≤1.3.1Update to 1.3.2
- High8.8SQL Injection
Slider by 10Web – Responsive Image Slider
≤1.2.35Update to 1.2.36