CWE-434Vulnerability type

WordPress Arbitrary File Upload vulnerabilities (page 1306)

Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Arbitrary File Upload vulnerabilities (page 1306)
Severity	Vulnerability	CVE	Installs	Published
Medium6.4	Authenticated Stored Cross-Site Scripting Simple Download Monitor<3.5.4Update to 3.5.4	CVE-2018-5212	—	Jan 2, 2018
Medium5.4	Authenticated Stored Cross-Site Scripting Simple Download Monitor<3.5.4Update to 3.5.4	CVE-2018-5213	—	Jan 2, 2018
High8.8	Cross-Site Request Forgery leading to Cross-Site Scripting via the recordsArray Parameter Social Media Widget by Acurax<3.2.6Update to 3.2.6	CVE-2018-6357	—	Jan 2, 2018
Medium6.1	Open Redirect furikake≤0.1.0Update to 0.1.1	CVE-2017-1000434	—	Jan 1, 2018
High7.2	Stored Cross-Site Scripting Smart Google Code Inserter<3.5Update to 3.5	CVE-2018-3810	—	Jan 1, 2018
Critical9.8	Unauthenticated SQL Injection Smart Google Code Inserter<3.5Update to 3.5	CVE-2018-3811	—	Jan 1, 2018
Medium6.1	Cross-Site Scripting mgl-instagram-galleryall versionsNo patch available	CVE-2017-17869	—	Dec 22, 2017
Medium5.4	Cross-Site Scripting CSV Import Export≤1.1No patch available	CVE-2017-17753	—	Dec 19, 2017
Medium6.1	Cross-Site Scripting WP Concours≤1.1No patch available	CVE-2017-17719	—	Dec 19, 2017
Critical9.8	Unauthenticated Arbitrary File Upload accesspress-anonymous-post-pro<3.2.0Update to 3.2.0	CVE-2017-16949	—	Dec 19, 2017
Medium6.1	Cross-Site Scripting Custom Map≤1.1No patch available	CVE-2017-17744	—	Dec 19, 2017
Medium6.1	Cross-Site Scripting Share This Image<1.04Update to 1.04	CVE-2017-18015	—	Dec 18, 2017
Medium6.1	Multiple Versions - Cross-Site Scripting Clockwork SMS Notfications≤2.0.3No patch available	CVE-2017-17780	—	Dec 18, 2017
Medium6.1	Cross-Site Scripting SagePay Server Gateway for WooCommerce<1.0.9Update to 1.0.9	CVE-2018-5316	—	Dec 17, 2017
Medium6.1	Cross-Site Scripting Smart Marketing SMS and Newsletters Forms<2.0.0Update to 2.0.0	CVE-2017-18010	—	Dec 5, 2017
Medium6.1	Cross-Site Scripting Z-URL Preview<2.0.0Update to 2.0.0	CVE-2017-18012	—	Dec 5, 2017
Medium6.1	Cross-Site Scripting WP Mailster<1.5.5Update to 1.5.5	CVE-2017-17451	—	Dec 5, 2017
Medium6.1	Reflected Cross-Site Scripting PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin<2.0.3Update to 2.0.3	CVE-2018-20970	—	Dec 4, 2017
Medium6.1	Reflected Cross-Site Scripting WordPress≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1	CVE-2017-17094	—	Nov 29, 2017
Medium5.4	Authorization Bypass WordPress≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1	CVE-2017-17091	—	Nov 29, 2017
Medium6.4	WordPress Core < 4.9.1- Stored Cross-Site Scripting via Language WordPress≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1	CVE-2017-17093	—	Nov 29, 2017
Medium6.4	Authenticated Stored Cross-Site Scripting WordPress≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1	CVE-2017-17092	—	Nov 29, 2017
Medium6.1	Cross-Site Scripting Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF≤5.2.0Update to 5.2.2	CVE-2018-0511	—	Nov 27, 2017
Medium6.1	Clockwork SMS <= 1.0.5 - Reflected Cross-Site Scripting Booking Calendar – Clockwork SMS≤1.0.5Update to 1.1.0	CVE-2017-18555	—	Nov 27, 2017
Medium6.1	Cross-Site Scripting Clockwork SMS Notfications<2.4.2Update to 2.4.2	CVE-2017-18495	—	Nov 27, 2017
High8.8	Missing Authorization Elementor Website Builder – more than just a page builder≤1.7.12Update to 1.8.0	CVE-2017-18596	—	Nov 27, 2017
Medium6.1	Reflected Cross-Site Scripting Contact Form 7 – Clockwork SMS<2.4.1Update to 2.4.1	CVE-2017-18489	—	Nov 27, 2017
High8.8	Authenticated SQL Injection inlinks≤1.1No patch available	CVE-2017-16955	—	Nov 22, 2017
Medium6.1	Cross-Site Scripting WP Customer Area<7.4.3Update to 7.4.3	CVE-2017-18519	—	Nov 22, 2017
Medium6.1	Reflected Cross-Site Scripting Yoast SEO – Advanced SEO with real-time guidance and built-in AI≤5.7.1Update to 5.8.0	CVE-2017-16842	—	Nov 22, 2017

Medium6.4
Authenticated Stored Cross-Site Scripting
Simple Download Monitor
<3.5.4Update to 3.5.4
CVE-2018-5212Jan 2, 2018
Medium5.4
Authenticated Stored Cross-Site Scripting
Simple Download Monitor
<3.5.4Update to 3.5.4
CVE-2018-5213Jan 2, 2018
High8.8
Cross-Site Request Forgery leading to Cross-Site Scripting via the recordsArray Parameter
Social Media Widget by Acurax
<3.2.6Update to 3.2.6
CVE-2018-6357Jan 2, 2018
Medium6.1
Open Redirect
furikake
≤0.1.0Update to 0.1.1
CVE-2017-1000434Jan 1, 2018
High7.2
Stored Cross-Site Scripting
Smart Google Code Inserter
<3.5Update to 3.5
CVE-2018-3810Jan 1, 2018
Critical9.8
Unauthenticated SQL Injection
Smart Google Code Inserter
<3.5Update to 3.5
CVE-2018-3811Jan 1, 2018
Medium6.1
Cross-Site Scripting
mgl-instagram-gallery
all versionsNo patch available
CVE-2017-17869Dec 22, 2017
Medium5.4
Cross-Site Scripting
CSV Import Export
≤1.1No patch available
CVE-2017-17753Dec 19, 2017
Medium6.1
Cross-Site Scripting
WP Concours
≤1.1No patch available
CVE-2017-17719Dec 19, 2017
Critical9.8
Unauthenticated Arbitrary File Upload
accesspress-anonymous-post-pro
<3.2.0Update to 3.2.0
CVE-2017-16949Dec 19, 2017
Medium6.1
Cross-Site Scripting
Custom Map
≤1.1No patch available
CVE-2017-17744Dec 19, 2017
Medium6.1
Cross-Site Scripting
Share This Image
<1.04Update to 1.04
CVE-2017-18015Dec 18, 2017
Medium6.1
Multiple Versions - Cross-Site Scripting
Clockwork SMS Notfications
≤2.0.3No patch available
CVE-2017-17780Dec 18, 2017
Medium6.1
Cross-Site Scripting
SagePay Server Gateway for WooCommerce
<1.0.9Update to 1.0.9
CVE-2018-5316Dec 17, 2017
Medium6.1
Cross-Site Scripting
Smart Marketing SMS and Newsletters Forms
<2.0.0Update to 2.0.0
CVE-2017-18010Dec 5, 2017
Medium6.1
Cross-Site Scripting
Z-URL Preview
<2.0.0Update to 2.0.0
CVE-2017-18012Dec 5, 2017
Medium6.1
Cross-Site Scripting
WP Mailster
<1.5.5Update to 1.5.5
CVE-2017-17451Dec 5, 2017
Medium6.1
Reflected Cross-Site Scripting
PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin
<2.0.3Update to 2.0.3
CVE-2018-20970Dec 4, 2017
Medium6.1
Reflected Cross-Site Scripting
WordPress
≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1
CVE-2017-17094Nov 29, 2017
Medium5.4
Authorization Bypass
WordPress
≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1
CVE-2017-17091Nov 29, 2017
Medium6.4
WordPress Core < 4.9.1- Stored Cross-Site Scripting via Language
WordPress
≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1
CVE-2017-17093Nov 29, 2017
Medium6.4
Authenticated Stored Cross-Site Scripting
WordPress
≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1
CVE-2017-17092Nov 29, 2017
Medium6.1
Cross-Site Scripting
Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF
≤5.2.0Update to 5.2.2
CVE-2018-0511Nov 27, 2017
Medium6.1
Clockwork SMS <= 1.0.5 - Reflected Cross-Site Scripting
Booking Calendar – Clockwork SMS
≤1.0.5Update to 1.1.0
CVE-2017-18555Nov 27, 2017
Medium6.1
Cross-Site Scripting
Clockwork SMS Notfications
<2.4.2Update to 2.4.2
CVE-2017-18495Nov 27, 2017
High8.8
Missing Authorization
Elementor Website Builder – more than just a page builder
≤1.7.12Update to 1.8.0
CVE-2017-18596Nov 27, 2017
Medium6.1
Reflected Cross-Site Scripting
Contact Form 7 – Clockwork SMS
<2.4.1Update to 2.4.1
CVE-2017-18489Nov 27, 2017
High8.8
Authenticated SQL Injection
inlinks
≤1.1No patch available
CVE-2017-16955Nov 22, 2017
Medium6.1
Cross-Site Scripting
WP Customer Area
<7.4.3Update to 7.4.3
CVE-2017-18519Nov 22, 2017
Medium6.1
Reflected Cross-Site Scripting
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤5.7.1Update to 5.8.0
CVE-2017-16842Nov 22, 2017