CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 1274)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Improper Access Controls
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
≤2.0.28Update to 2.0.29
- Medium4.3Cross-Site Request Forgery Bypass
Ocean Extra
<1.6.6Update to 1.6.6
- Medium4.3Cross-Site Request Forgery Bypass
Hueman
≤3.6.3Update to 3.6.4
- Medium4.3Cross-Site Request Forgery Bypass
Customizr
≤4.3.0Update to 4.3.1
- Medium4.3Cross-Site Request Forgery Bypass
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
<1.6.4Update to 1.6.4
- Medium4.3Cross-Site Request Forgery Bypass
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
<1.5.16Update to 1.5.16
- Critical9.8Arbitrary File Upload
Simple:Press Forum
<6.6.1Update to 6.6.1
- Critical9.8SQL Injection
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.3.2Update to 2.3.3
- High7.5Insecure Cryptography to Sensitive Information Disclosure
W3 Total Cache
≤0.9.2.4Update to 0.9.2.5
- High8.8Cross-Site Request Forgery to Plugin Installation
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.4.27Update to 3.4.27.1
- Medium5.3Validation Bypass via Email Field
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.4.27Update to 3.4.27.1
- Medium6.1Cross-Site Scripting
UpdraftPlus Premium
<1.9.64Update to 1.9.64
- High7.5Password Hash Extraction
W3 Total Cache
≤0.9.2.4Update to 0.9.2.5
- High7.5Sensitive Information Exposure
W3 Total Cache
≤0.9.2.4Update to 0.9.2.5
- Critical9.8SQL Injection
Advanced Contact form 7 DB
≤1.6.2Update to 1.7.0
- Medium6.1Reflected Cross-Site Scripting
15Zine | Magazine Newspaper Blog News WordPress Theme
<3.3.0Update to 3.3.0
- Medium6.5Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.4.27.1Update to 3.4.28
- High7.5Stored Cross-Site Scripting
Team Showcase
<1.22.16Update to 1.22.16
- High7.5Object Injection
Team Showcase
<1.22.16Update to 1.22.16
- High7.5Stored Cross-Site Scripting
Team Showcase
<1.22.16Update to 1.22.16
- High7.5Object Injection
Team Showcase
<1.22.16Update to 1.22.16
- Medium4.3Cross-Site Request Forgery Bypass
WP Hotel Booking
<1.10.2Update to 1.10.2
- Medium4.3Cross-Site Request Forgery Bypass
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
<3.4.3Update to 3.4.3
- Medium4.3Cross-Site Request Forgery Bypass
10WebAnalytics
<1.2.9Update to 1.2.9
- Medium4.3Cross-Site Request Forgery Bypass
WebberZone Top 10 — Popular Posts
<2.9.5Update to 2.9.5
- Medium4.3Cross-Site Request Forgery Bypass
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts
<2.3.10Update to 2.3.10
- Medium4.3Cross-Site Request Forgery Bypass
Coming Soon & Maintenance Mode Page & Under Construction
≤1.57Update to 1.58
- Medium4.3Cross-Site Request Forgery Bypass
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
<2.4.3Update to 2.4.3
- Medium4.3Cross-Site Request Forgery Bypass
Import / Export Customizer Settings
<1.0.4Update to 1.0.4
- Medium4.3Cross-Site Request Forgery Bypass
Radio Buttons for Taxonomies
<2.0.6Update to 2.0.6