CWE-434Vulnerability type

WordPress Arbitrary File Upload vulnerabilities (page 1278)

Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Arbitrary File Upload vulnerabilities (page 1278)
Severity	Vulnerability	CVE	Installs	Published
Critical9.8	wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter Comments – wpDiscuz<5.3.6Update to 5.3.6	CVE-2020-13640	—	Jun 12, 2020
Low2.4	Self-Cross Site Scripting via Theme Folder Name WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2	CVE-2020-4049	—	Jun 10, 2020
Medium6.1	Cross-Site Scripting Advanced Custom Fields (ACF®)<5.8.12Update to 5.8.12	CVE-2020-36172	—	Jun 10, 2020
Low3.5	Arbitrary User Meta Update WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2	CVE-2020-4050	—	Jun 10, 2020
Medium5.3	Comment Disclosure WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2	CVE-2020-25286	—	Jun 10, 2020
Medium5.7	Open Redirect WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2	CVE-2020-4048	—	Jun 10, 2020
Medium6.8	Authenticated Stored Cross-Site Scripting WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2	CVE-2020-4047	—	Jun 10, 2020
Medium5.4	Authenticated Stored Cross-Site Scripting WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2	CVE-2020-4046	—	Jun 10, 2020
Medium5.4	Cross-Site Scripting SportsPress – Sports Club & League Manager<2.7.2Update to 2.7.2	CVE-2020-13892	—	Jun 7, 2020
High7.2	Admin+ SQL Injection Events Manager – Calendar, Bookings, Tickets, Appointments and more!≤5.9.7.3Update to 5.9.8	CVE-2020-35012	—	Jun 7, 2020
Medium6.1	Cross-Site Scripting Events Manager – Calendar, Bookings, Tickets, Appointments and more!≤5.9.7.3Update to 5.9.8	CVE-2020-35037	—	Jun 7, 2020
Medium5.4	Stored Cross-Site Scripting Elementor Website Builder – more than just a page builder≤2.9.8Update to 2.9.9	CVE-2020-13864	—	Jun 5, 2020
Medium5.4	Stored Cross-Site Scripting Elementor Website Builder – more than just a page builder≤2.9.8Update to 2.9.9	CVE-2020-13865	—	Jun 5, 2020
Critical9.8	Contact Form 7 <= 1.3.3.2 - Arbitrary File Upload Drag and Drop Multiple File Upload for Contact Form 7≤1.3.3.2Update to 1.3.3.3	CVE-2020-12800	—	Jun 4, 2020
High7.2	Authenticated SQL Injection AdRotate Banner Manager<5.8.4Update to 5.8.4	CVE-2021-24138	—	Jun 3, 2020
Medium6.1	Cross-Site Scripting Careerfy - Job Board WordPress Theme<3.9.0Update to 3.9.0	CVE-2022-1169	—	Jun 3, 2020
High7.1	Reflected Cross-Site Scripting JobSearch WP Job Board<1.5.1Update to 1.5.1	CVE-2022-1168	—	Jun 3, 2020
High7.4	Authorization Bypass to Settings Updates Brizy – Page Builder<1.0.126Update to 1.0.126	CVE-2020-36714	—	Jun 3, 2020
Medium4.8	Cross-Site Scripting FooGallery Photo Gallery : Image, Video & Masonry Galleries≤1.8.12Update to 1.8.18	CVE-2019-20182	—	Jun 1, 2020
High7.2	Authenticated (Admin+) Arbitrary File Upload Allow svg files<1.1Update to 1.1	CVE-2022-1939	—	May 30, 2020
High7.3	Authenticated CSV Injection Connections Business Directory≤9.6Update to 9.7	CVE-2020-36503	—	May 29, 2020
High7.5	Insecure direct object reference via permalinks manipulation ACF to REST API≤3.2.0Update to 3.3.0	CVE-2020-13700	—	May 29, 2020
High8.8	Authenticated SQL Injection Blog2Social: Social Media Auto Post & Scheduler≤6.3.0Update to 6.3.1	CVE-2021-24137	—	May 29, 2020
Critical9.8	Unauthenticated Privilege Escalation bbPress≤2.6.4Update to 2.6.5	CVE-2020-13693	—	May 28, 2020
High7.4	Missing Authorization to Cross-Site Scripting Page Builder: Pagelayer – Drag and Drop website builder<1.1.2Update to 1.1.2	CVE-2020-35947	—	May 28, 2020
Medium4.8	Authenticated (Admin+) Stored Cross-Site Scripting via the forums list table bbPress≤2.6.4Update to 2.6.5	CVE-2020-13487	—	May 28, 2020
High8.8	Remote Code Execution via Improper Capability Checks in AJAX Calls MapPress – Free Map Plugin for Google Maps & OpenStreetMap≤2.54.5Update to 2.54.6	CVE-2020-12675	—	May 28, 2020
Medium6.4	Authenticated Stored Cross-Site Scripting Image Photo Gallery Final Tiles Grid≤3.4.18Update to 3.4.19	CVE-2020-14962	—	May 28, 2020
High8.8	Cross-Site Request Forgery to Cross-Site Scripting Page Builder: Pagelayer – Drag and Drop website builder<1.1.2Update to 1.1.2	CVE-2020-35944	—	May 28, 2020
Medium5.4	Stored Cross-Site Scripting ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin≤3.9.2Update to 3.9.3	CVE-2021-24127	—	May 22, 2020

Critical9.8
wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter
Comments – wpDiscuz
<5.3.6Update to 5.3.6
CVE-2020-13640Jun 12, 2020
Low2.4
Self-Cross Site Scripting via Theme Folder Name
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
CVE-2020-4049Jun 10, 2020
Medium6.1
Cross-Site Scripting
Advanced Custom Fields (ACF®)
<5.8.12Update to 5.8.12
CVE-2020-36172Jun 10, 2020
Low3.5
Arbitrary User Meta Update
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
CVE-2020-4050Jun 10, 2020
Medium5.3
Comment Disclosure
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
CVE-2020-25286Jun 10, 2020
Medium5.7
Open Redirect
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
CVE-2020-4048Jun 10, 2020
Medium6.8
Authenticated Stored Cross-Site Scripting
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
CVE-2020-4047Jun 10, 2020
Medium5.4
Authenticated Stored Cross-Site Scripting
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
CVE-2020-4046Jun 10, 2020
Medium5.4
Cross-Site Scripting
SportsPress – Sports Club & League Manager
<2.7.2Update to 2.7.2
CVE-2020-13892Jun 7, 2020
High7.2
Admin+ SQL Injection
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.9.7.3Update to 5.9.8
CVE-2020-35012Jun 7, 2020
Medium6.1
Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.9.7.3Update to 5.9.8
CVE-2020-35037Jun 7, 2020
Medium5.4
Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.9.8Update to 2.9.9
CVE-2020-13864Jun 5, 2020
Medium5.4
Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.9.8Update to 2.9.9
CVE-2020-13865Jun 5, 2020
Critical9.8
Contact Form 7 <= 1.3.3.2 - Arbitrary File Upload
Drag and Drop Multiple File Upload for Contact Form 7
≤1.3.3.2Update to 1.3.3.3
CVE-2020-12800Jun 4, 2020
High7.2
Authenticated SQL Injection
AdRotate Banner Manager
<5.8.4Update to 5.8.4
CVE-2021-24138Jun 3, 2020
Medium6.1
Cross-Site Scripting
Careerfy - Job Board WordPress Theme
<3.9.0Update to 3.9.0
CVE-2022-1169Jun 3, 2020
High7.1
Reflected Cross-Site Scripting
JobSearch WP Job Board
<1.5.1Update to 1.5.1
CVE-2022-1168Jun 3, 2020
High7.4
Authorization Bypass to Settings Updates
Brizy – Page Builder
<1.0.126Update to 1.0.126
CVE-2020-36714Jun 3, 2020
Medium4.8
Cross-Site Scripting
FooGallery Photo Gallery : Image, Video & Masonry Galleries
≤1.8.12Update to 1.8.18
CVE-2019-20182Jun 1, 2020
High7.2
Authenticated (Admin+) Arbitrary File Upload
Allow svg files
<1.1Update to 1.1
CVE-2022-1939May 30, 2020
High7.3
Authenticated CSV Injection
Connections Business Directory
≤9.6Update to 9.7
CVE-2020-36503May 29, 2020
High7.5
Insecure direct object reference via permalinks manipulation
ACF to REST API
≤3.2.0Update to 3.3.0
CVE-2020-13700May 29, 2020
High8.8
Authenticated SQL Injection
Blog2Social: Social Media Auto Post & Scheduler
≤6.3.0Update to 6.3.1
CVE-2021-24137May 29, 2020
Critical9.8
Unauthenticated Privilege Escalation
bbPress
≤2.6.4Update to 2.6.5
CVE-2020-13693May 28, 2020
High7.4
Missing Authorization to Cross-Site Scripting
Page Builder: Pagelayer – Drag and Drop website builder
<1.1.2Update to 1.1.2
CVE-2020-35947May 28, 2020
Medium4.8
Authenticated (Admin+) Stored Cross-Site Scripting via the forums list table
bbPress
≤2.6.4Update to 2.6.5
CVE-2020-13487May 28, 2020
High8.8
Remote Code Execution via Improper Capability Checks in AJAX Calls
MapPress – Free Map Plugin for Google Maps & OpenStreetMap
≤2.54.5Update to 2.54.6
CVE-2020-12675May 28, 2020
Medium6.4
Authenticated Stored Cross-Site Scripting
Image Photo Gallery Final Tiles Grid
≤3.4.18Update to 3.4.19
CVE-2020-14962May 28, 2020
High8.8
Cross-Site Request Forgery to Cross-Site Scripting
Page Builder: Pagelayer – Drag and Drop website builder
<1.1.2Update to 1.1.2
CVE-2020-35944May 28, 2020
Medium5.4
Stored Cross-Site Scripting
ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
≤3.9.2Update to 3.9.3
CVE-2021-24127May 22, 2020