CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 1276)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Scripting via id Parameter
WP Floating Menu – One page navigator, sticky menu for WordPress
<1.4.1Update to 1.4.1
- High7.2Authenticated Arbitrary File Upload
Autoptimize
≤2.7.6Update to 2.7.7
- High7.1Missing Authorization to Settings Update
Kali Forms — Contact Form & Drag-and-Drop Builder
<2.1.2Update to 2.1.2
- High8.6Unauthenticated Arbitrary Post Deletion
Kali Forms — Contact Form & Drag-and-Drop Builder
<2.1.2Update to 2.1.2
- High8.8Cross-Site Request Forgery
Kali Forms — Contact Form & Drag-and-Drop Builder
<2.1.2Update to 2.1.2
- High7.5Payment System Bypass
NAB Transact
<2.1.2Update to 2.1.2
- Medium6.3Missing Authorization
Discount Rules for WooCommerce
≤2.0.2Update to 2.1.0
- Medium6.1Multiple Stored Cross-Site Scripting
WP Customer Reviews
≤3.4.2Update to 3.4.3
- Medium4.3Authenticated Information Disclosure
Access Governance for WordPress (aka AAM)
≤6.6.1Update to 6.6.2
- High8.84.2.12 - Unprotected AJAX Actions
Backup, Restore and Migrate your sites with XCloner
4.2.1 – 4.2.12Update to 4.2.153
- Critical9.8Cross-Site Request Forgery
Backup, Restore and Migrate your sites with XCloner
<4.2.153Update to 4.2.153
- High7.5Authenticated Authorization Bypass and Privilege Escalation
Access Governance for WordPress (aka AAM)
≤6.6.1Update to 6.6.2
- High8.6CSV injection via form entry
weForms – Easy Drag & Drop Contact Form Builder For WordPress
≤1.4.7Update to 1.4.8
- High7.5Unauthenticated Resource Access to Site Backups
File Manager
≤6.4Update to 6.5
- Medium6.1Cross-Site Scripting
Sell Media
<2.4.2Update to 2.4.2
- Medium6.1Reflected Cross-Site Scripting
Ultimate Appointment Booking & Scheduling
<1.1.10Update to 1.1.10
- Medium6.1Reflected Cross-Site Scripting
Admin Menu
≤1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
RSS Feed Widget
<2.8.1Update to 2.8.1
- Medium6.1Reflected Cross-Site Scripting
Nova Lite
<1.3.9Update to 1.3.9
- High7.4Missing Capabilities Check
Facebook Chat Plugin – Live Chat Plugin for WordPress
<1.6Update to 1.6
- High8.3Missing Authorization
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
≤3.8.1Update to 3.8.2
- Critical9.8Arbitrary File Upload
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
<7.0.1Update to 7.0.1
- High8.8Arbitrary File Upload
Divi Builder
≤4.3.2Update to 4.5.3
- Medium6.5Reflected Cross-Site Scripting
Newsletter – Send awesome emails from WordPress
<6.8.2Update to 6.8.2
- High7.5Missing Authorization
Product Input Fields for WooCommerce
≤1.2.6Update to 1.2.7
- High8.2Unauthenticated Arbitrary File Deletion
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
<7.0.1Update to 7.0.1
- High7.5Authenticated PHP Object Injection
Newsletter – Send awesome emails from WordPress
<6.8.2Update to 6.8.2
- Medium5.4Missing Authorization to Unauthorized Backup Location Change
JetBackup – Backup, Restore & Migrate
≤1.4.0Update to 1.4.1
- Medium4.3Sensitive Information Disclosure
JetBackup – Backup, Restore & Migrate
≤1.4.0Update to 1.4.1
- High8.8Cross-Site Request Forgery
Social Rocket – Social Sharing Plugin
<1.2.10Update to 1.2.10