CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 1316)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.4 | Cross-Site Scripting | CVE-2017-18579 | — | |
| High8.1 | Authenticated Directory Traversal leading to Local File Inclusion | CVE-2017-18585 | — | |
| High7.5 | Directory Traversal | CVE-2017-20287 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18541 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-9288 | — | |
| Critical9.8 | SQL Injection | CVE-2017-18548 | — | |
| High7.3 | Arbitrary Page Modification WordPress≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2 | CVE-2017-1001000 | — | |
| Medium6.1 | Cross-Site Scripting WordPress≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2 | CVE-2017-5612 | — | |
| High8.8 | Authenticated SQL Injection WordPress≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2 | CVE-2017-5611 | — | |
| Medium4.3 | Authorization Bypass to Term Disclosure WordPress≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2 | CVE-2017-5610 | — | |
| Critical9.8 | Unauthenticated PHP Object Injection | CVE-2016-15004 | — | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting | CVE-2017-20177 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18526 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18576 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18536 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18612 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10892 | — | |
| High8.8 | Cross-Site Request Forgery via Widget Editing WordPress≤4.7Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5492 | — | |
| Medium5.3 | Weak Multi-Site Activation Key for User and Site Signup WordPress≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5493 | — | |
| Medium4.3 | Information Disclosure WordPress≤4.7Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5487 | — | |
| Medium5.5 | Stored Cross-Site Scripting via theme directory name WordPress≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5490 | — | |
| High8.3 | Authorization Bypass WordPress≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5491 | — | |
| High8.8 | Cross-Site Request Forgery via Uploading Flash File WordPress≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5489 | — | |
| Medium5.5 | Cross-Site Scripting via Name and Version Header of Plugin WordPress≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5488 | — | |
| Critical9.9 | Local File Inclusion | CVE-2017-20289 | — | |
| Medium4.3 | Path Disclosure WordPress≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2 | CVE-2017-6514 | — | |
| High7.2 | Server-Side Request Forgery | CVE-2016-10927 | — | |
| Medium5.4 | Missing Authorization & Cross-Site Request Forgery | CVE-2016-10938 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2016-10939 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2016-10943 | — |
- Medium6.4Cross-Site Scripting
Corner Ad
<1.0.8Update to 1.0.8
- High8.1Authenticated Directory Traversal leading to Local File Inclusion
Posts in Page
<1.3.0Update to 1.3.0
- High7.5Directory Traversal
Javo Spot - Multi Purpose Directory WordPress Theme
<3.0.0Update to 3.0.0
- Medium6.1Cross-Site Scripting
XO Security
<1.5.3Update to 1.5.3
- Medium6.1Reflected Cross-Site Scripting
Raygun
≤1.8.0Update to 1.8.1
- Critical9.8SQL Injection
Note Press
<0.1.2Update to 0.1.2
- High7.3Arbitrary Page Modification
WordPress
≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2
- Medium6.1Cross-Site Scripting
WordPress
≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2
- High8.8Authenticated SQL Injection
WordPress
≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2
- Medium4.3Authorization Bypass to Term Disclosure
WordPress
≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2
- Critical9.8Unauthenticated PHP Object Injection
InfiniteWP Client
<1.6.1.1Update to 1.6.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
WangGuard
<1.8.0Update to 1.8.0
- Medium6.1Cross-Site Scripting
moreAds SE
≤1.4.6Update to 1.4.7
- Medium6.1Cross-Site Scripting
Event Notifier
≤1.2.0Update to 1.2.1
- Medium6.1Cross-Site Scripting
Stop User Enumeration
<1.3.8Update to 1.3.8
- Medium6.1Reflected Cross-Site Scripting
WP Whois Domain
≤1.0.0No patch available
- Medium6.1Cross-Site Scripting
Chained Quiz
<1.0Update to 1.0
- High8.8Cross-Site Request Forgery via Widget Editing
WordPress
≤4.7Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- Medium5.3Weak Multi-Site Activation Key for User and Site Signup
WordPress
≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- Medium4.3Information Disclosure
WordPress
≤4.7Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- Medium5.5Stored Cross-Site Scripting via theme directory name
WordPress
≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- High8.3Authorization Bypass
WordPress
≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- High8.8Cross-Site Request Forgery via Uploading Flash File
WordPress
≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- Medium5.5Cross-Site Scripting via Name and Version Header of Plugin
WordPress
≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- Critical9.9Local File Inclusion
Ad Widget for WordPress
<2.12.0Update to 2.12.0
- Medium4.3Path Disclosure
WordPress
≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2
- High7.2Server-Side Request Forgery
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
<4.5.11Update to 4.5.11
- Medium5.4Missing Authorization & Cross-Site Request Forgery
copy-me
≤1.0.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
Xtreme Locator
≤3.0.1No patch available
- High7.2Authenticated (Admin+) SQL Injection
ZX_CSV Upload
≤1No patch available