CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 1304)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.8Cross-Site Scripting via flickrRSS_tags
flickrRSS
≤5.3.1No patch available
- Medium4.3Cross-Site Request Forgery
flickrRSS
≤5.3.1No patch available
- Medium4.8Cross-Site Scripting via flickrRSS_id
flickrRSS
≤5.3.1No patch available
- Medium4.8Cross-Site Scripting via flickrRSS_set
flickrRSS
≤5.3.1No patch available
- High7.5Denial of Service
WordPress
<5.0Update to 5.0
- Medium6.1Cross-Site Scripting
Property Hive
<1.4.15Update to 1.4.15
- High8.8PHP Object Injection
Splashing Images
≤2.1Update to 2.1.1
- Medium6.1Cross-Site Scripting
Splashing Images
<2.1.1Update to 2.1.1
- High7.5Unauthenticated Subscriber Download
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤3.4.7Update to 3.4.8
- Medium5.5Stored Cross-Site Scripting
Coming Soon Page – Responsive Coming Soon & Maintenance Mode
<1.1.19Update to 1.1.19
- Medium6.1Cross-Site Scripting
Soundy Background Music
≤3.9No patch available
- Medium6.1Cross-Site Scripting
Soundy Audio Playlist
≤4.6No patch available
- Medium5.4Stored Cross-Site Scripting
BuddyBoss Media
≤3.2.3Update to 3.2.4
- Medium6.4Authenticated Cross-Site Scripting
WordPress
≤4.9.1Update to 3.7.25 or 3.8.25 or 3.9.23 or 4.0.22 or 4.1.22 or 4.2.19 or 4.3.15 or 4.4.14 or 4.5.13 or 4.6.10 or 4.7.9 or 4.8.5 or 4.9.2
- Medium6.1Cross-Site Scripting
Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF
<5.2.3Update to 5.2.3
- Medium5.5Cross-Site Scripting via coming-soon_sub_title parameter
Coming Soon Page – Responsive Coming Soon & Maintenance Mode
≤1.1.18Update to 1.1.19
- Medium5.5Cross-Site Scripting via logo_height parameter
Coming Soon Page – Responsive Coming Soon & Maintenance Mode
≤1.1.18Update to 1.1.19
- Medium5.5Stored Cross-Site Scripting
Read and Understood
≤2.1Update to 2.2
- Medium5.5Cross-Site Scripting via bg_color parameter
Coming Soon Page – Responsive Coming Soon & Maintenance Mode
≤1.1.18Update to 1.1.19
- High8.8Cross-Site Request Forgery
Booking calendar, Appointment Booking System
<2.1.8Update to 2.1.8
- Medium5.5Cross-Site Scripting via button_text_link parameter
Coming Soon Page – Responsive Coming Soon & Maintenance Mode
≤1.1.18Update to 1.1.19
- Medium6.1Cross-Site Scripting
Weblizar Pin Feeds
<1.1.2Update to 1.1.2
- Medium5.5Cross-Site Scripting via counter_title parameter
Coming Soon Page – Responsive Coming Soon & Maintenance Mode
≤1.1.18Update to 1.1.19
- High8.8Cross-Site Request Forgery
Coming Soon Page – Responsive Coming Soon & Maintenance Mode
≤1.1.18Update to 1.1.19
- Medium5.5Cross-Site Scripting via logo_width parameter
Coming Soon Page – Responsive Coming Soon & Maintenance Mode
≤1.1.18Update to 1.1.19
- Medium6.1Reflected Cross-Site Scripting
Weblizar Pin Feeds
<1.1.2Update to 1.1.2
- Medium4.8Cross-Site Scripting
Markdown Editor (Formerly Dark Mode)
<1.7Update to 1.7
- Medium6.4Stored Cross-Site Scripting
Markdown Editor (Formerly Dark Mode)
<1.7Update to 1.7
- Medium5.5Cross-Site Scripting via social_icon_1 parameter
Coming Soon Page – Responsive Coming Soon & Maintenance Mode
≤1.1.18Update to 1.1.19
- Medium5.5Stored Cross-Site Scripting
Coming Soon Page – Responsive Coming Soon & Maintenance Mode
<1.1.19Update to 1.1.19