CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 1303)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.1Cross-Site Scripting via Shortcodes
Iptanus File Upload
<4.3.3Update to 4.3.3
- Medium5.4Cross-Site Scripting
Relevanssi – A Better Search
≤4.0.4Update to 4.0.5
- Medium6.5Cross-Site Request Forgery to Denial of Service
WP Image Zoom
≤1.23Update to 1.24
- Medium5.3Sensitive Information Disclosure
WP Activity Log
≤3.1.1Update to 3.1.2
- Medium6.4Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.8.1.2Update to 5.8.1.2
- Critical9.8Local File Inclusion
Site Editor
≤1.1.1No patch available
- Medium6.1Cross-Site Scripting
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤1.2.32Update to 1.2.33
- Medium5.3Spam Injection
MailPoet Newsletters (Previous)
≤2.8.1Update to 2.8.2
- Critical9.8Object Injection
Newsletters
<4.6.8.6Update to 4.6.8.6
- High8.8Cross-Site Request Forgery
bbPress Move Topics
<1.1.5Update to 1.1.5
- High8.8PHP Object Injection
bbPress Move Topics
≤1.1.4Update to 1.1.6
- Medium6.1Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
<3.4.6Update to 3.4.6
- Medium6.1Multiple Cross-Site Scripting
Activity Log – Monitor User and Agent Changes
≤2.4.0Update to 2.4.1
- Medium6.1Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
<3.4.7Update to 3.4.7
- Medium6.1Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
<3.4.7Update to 3.4.7
- Critical9.8Products Filter for WooCommerce <= 1.1.9 - Remote Code Execution
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard
<1.2.0Update to 1.2.0
- Critical9.8Products Filter for WooCommerce <= 1.1.9 - Local File Inclusion
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard
<1.2.0Update to 1.2.0
- High7.5Cross-Site Scripting
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
≤6.9.0Update to 6.9.1
- High7.5Sensitive Information Disclosure
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.2.46Update to 2.2.50
- High7.5Information Disclosure
File Manager
≤5.0.0Update to 5.0.2
- Medium6.1Cross-Site Scripting
trust-form
≤2.0.0Update to 2.0.1
- High7.5Parameter Tampering
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.2.15Update to 3.2.15
- Critical9.8SQL Injection
WP Support Plus Responsive Ticket System
≤9.0.2Update to 9.0.3
- Medium6.1Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.2.14Update to 3.2.14
- Medium4.8Cross-Site Scripting via image alt and title text
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.2.44Update to 2.2.45
- High8.8Cross-Site Request Forgery
Church Admin
<1.2550Update to 1.2550
- Medium6.1Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.4Update to 2.0.4
- Medium6.1Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0Update to 2.0.4
- High7.2Cross-Site Scripting
Online Scheduling and Appointment Booking System – Bookly
≤14.5Update to 14.6
- Critical9.8App Showcase & App Store WordPress Theme < 1.2.1 - Missing Authorization to Arbitrary Options Update
Swape - App Showcase & App Store WordPress Theme
<1.2.1Update to 1.2.1