CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 1300)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.3 | Authorization Bypass | CVE-2018-20979 | — | |
| Medium6.1 | Unauthenticated Cross-Site Scripting | CVE-2018-16285 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2018-17138 | — | |
| Critical9.8 | Sensitive Information Disclosure leading to Remote Code Execution Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More≤1.2.40Update to 1.2.42 | CVE-2018-17207 | 1M+ | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2018-17140 | — | |
| High8.8 | Remote Command Injection | CVE-2018-15877 | — | |
| Critical9.8 | SQL Injection | CVE-2018-16159 | — | |
| Medium5.3 | CAPTCHA Reuse | CVE-2018-15876 | — | |
| High7.3 | CSV Injection | CVE-2019-15092 | — | |
| High8.6 | CSV Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.3.13Update to 3.3.14 | CVE-2018-16308 | — | |
| High8.8 | Insecure Deserialization | CVE-2017-1000600 | — | |
| Critical9.8 | Unauthenticated SQL Injection | CVE-2018-14502 | — | |
| High8.6 | CSV Injection | CVE-2018-15571 | — | |
| Medium6.6 | Authenticated(Administrator+) PHP File Upload WordPress≤6.4.2Update to 4.1.40 or 4.2.37 or 4.3.33 or 4.4.32 or 4.5.31 or 4.6.28 or 4.7.28 or 4.8.24 or 4.9.25 or 5.0.21 or 5.1.18 or 5.2.20 or 5.3.17 or 5.4.15 or 5.5.14 or 5.6.13 or 5.7.11 or 5.8.9 or 5.9.9 or 6.0.7 or 6.1.5 or 6.2.4 or 6.3.3 or 6.4.3 | CVE-2018-14028 | — | |
| Medium6.5 | Authenticated (Custom+) Arbitrary File Deletion | CVE-2018-25308 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-17884 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-20966 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2018-14846 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2018-17947 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-14430 | — | |
| Medium4.8 | Cross-Site Scripting | CVE-2018-13137 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-21001 | — | |
| Medium6.4 | < 1.10.4 - Cross-Site Scripting | CVE-2018-14071 | — | |
| High7.2 | Local File Inclusion | CVE-2018-1000504 | — | |
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2018-13832 | — | |
| Critical9.1 | Insufficient Restrictions during Export Personal Data requests | CVE-2018-20981 | — | |
| High8.8 | Authenticated Arbitrary File Deletion WordPress≤4.9.6Update to 3.7.27 or 3.8.27 or 3.9.25 or 4.0.24 or 4.1.24 or 4.2.21 or 4.3.17 or 4.4.16 or 4.5.15 or 4.6.12 or 4.7.11 or 4.8.7 or 4.9.7 | CVE-2018-12895 | — | |
| Medium6.1 | Authenticated Cross-Site Scripting | CVE-2018-13136 | — | |
| Medium6.1 | 6.6.4 - Cross-Site Scripting | CVE-2018-0642 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-11105 | — |
- Medium6.3Authorization Bypass
Contact Form 7
<5.0.4Update to 5.0.4
- Medium6.1Unauthenticated Cross-Site Scripting
UserPro - Community and User Profile WordPress Plugin
≤4.9.23Update to 4.9.24
- Medium6.4Authenticated Stored Cross-Site Scripting
Jibu Pro
≤1.7No patch available
- Critical9.8Sensitive Information Disclosure leading to Remote Code Execution
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤1.2.40Update to 1.2.42
- Medium6.4Authenticated Stored Cross-Site Scripting
Quizlord
≤2.0No patch available
- High8.8Remote Command Injection
Plainview Activity Monitor
<20180826Update to 20180826
- Critical9.8SQL Injection
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)
<4.1.8Update to 4.1.8
- Medium5.3CAPTCHA Reuse
Ajax BootModal Login
≤1.4.3No patch available
- High7.3CSV Injection
Export and Import Users and Customers
<1.3.2Update to 1.3.2
- High8.6CSV Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.3.13Update to 3.3.14
- High8.8Insecure Deserialization
WordPress
<4.9Update to 4.9
- Critical9.8Unauthenticated SQL Injection
Chained Quiz
<1.0.9Update to 1.0.9
- High8.6CSV Injection
Export Users to CSV
≤1.1.1No patch available
- Medium6.6Authenticated(Administrator+) PHP File Upload
WordPress
≤6.4.2Update to 4.1.40 or 4.2.37 or 4.3.33 or 4.4.32 or 4.5.31 or 4.6.28 or 4.7.28 or 4.8.24 or 4.9.25 or 5.0.21 or 5.1.18 or 5.2.20 or 5.3.17 or 5.4.15 or 5.5.14 or 5.6.13 or 5.7.11 or 5.8.9 or 5.9.9 or 6.0.7 or 6.1.5 or 6.2.4 or 6.3.3 or 6.4.3
- Medium6.5Authenticated (Custom+) Arbitrary File Deletion
BuddyPress Xprofile Custom Fields Type
≤2.6.3No patch available
- Medium6.1Cross-Site Scripting
Gwolle Guestbook
≤2.5.3Update to 2.5.4
- Medium6.1Cross-Site Scripting
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
<3.8.0Update to 3.8.0
- Medium6.4Stored Cross-Site Scripting
Multi Step Form
<1.2.6Update to 1.2.6
- Medium6.1Multiple Cross-Site Scripting
Snazzy Maps
≤1.1.4Update to 1.1.5
- Medium6.1Reflected Cross-Site Scripting
Multi Step Form
<1.2.6Update to 1.2.6
- Medium4.8Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.9.4Update to 5.9.5
- Medium6.1Cross-Site Scripting
AnyComment
≤0.0.32Update to 0.0.33
- Medium6.4< 1.10.4 - Cross-Site Scripting
Geo Mashup
<1.10.4Update to 1.10.4
- High7.2Local File Inclusion
Redirection
≤2.7.3Update to 2.8
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
All In One Favicon
≤4.6Update to 4.7
- Critical9.1Insufficient Restrictions during Export Personal Data requests
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.3.8Update to 3.3.9
- High8.8Authenticated Arbitrary File Deletion
WordPress
≤4.9.6Update to 3.7.27 or 3.8.27 or 3.9.25 or 4.0.24 or 4.1.24 or 4.2.21 or 4.3.17 or 4.4.16 or 4.5.15 or 4.6.12 or 4.7.11 or 4.8.7 or 4.9.7
- Medium6.1Authenticated Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.17Update to 2.0.18
- Medium6.16.6.4 - Cross-Site Scripting
FV Flowplayer Video Player
6.1.2 – 6.6.4Update to 6.6.5
- Medium6.1Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤8.0.07Update to 8.0.08