CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 1334)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Information Disclosure
Axioma Premium Responsive
<1.1.2Update to 1.1.2
- Medium6.1Cross-Site Scripting
Awesome Support – WordPress HelpDesk & Support Plugin
<3.1.7Update to 3.1.7
- High7.5Sensitive Information Disclosure
Invento | Architecture Building Agency Template
≤2015-05-15No patch available
- High7.5Sensitive Information Disclosure
Accio | Responsive Onepage Parallax Site Template
<1.1.1Update to 1.1.1
- High7.5Sensitive Information Disclosure
Almera Responsive Portfolio Site Template
<1.1.8Update to 1.1.8
- High7.5Sensitive Information Disclosure
Accio | Responsive Onepage Parallax Agency WordPress Theme
≤1.1.0Update to 1.1.1
- High7.5Information Disclosure
SmartIT Premium Responsive
all versionsNo patch available
- High7.5Sensitive Information Disclosure
Car Dealer Automotive WordPress Theme – Responsive
<1.1.9Update to 1.1.9
- High7.5Sensitive Information Disclosure
Diplomat | Political Campaign, Party, Blog Responsive WordPress Theme
≤1.0.1Update to 1.0.2
- High7.5Sensitive Information Disclosure
GamesTheme
≤1.0.3No patch available
- Medium6.1Reflected Cross-Site Scripting
FeedWordPress
<2015.0514Update to 2015.0514
- Medium6.1Cross-Site Scripting
Post Kinds
<1.3.1.1Update to 1.3.1.1
- Medium6.1DOM-based Cross-Site Scripting
Syndication Links
<1.3Update to 1.3
- Medium6.1Cross-Site Scripting
Modern
≤1.4.1Update to 1.4.2
- Medium6.1Reflected Cross-Site Scripting
Google AdSense Click-Fraud Monitoring Plugin
≤1.8.6No patch available
- Medium4.3Cross-Site Request Forgery
Inline Google Spreadsheet Viewer
≤0.9.6Update to 0.9.6.1
- High8.8Remote Command Execution
Backup, Restore and Migrate your sites with XCloner
≤3.1.2Update to 3.1.3
- Medium6.1Cross-Site Scripting
Backup, Restore and Migrate your sites with XCloner
≤3.1.2Update to 3.1.3
- Critical9.8Remote Code Execution
Backup, Restore and Migrate your sites with XCloner
<3.1.3Update to 3.1.3
- High7.2Cross-Site Scripting
Roomcloud
<1.3Update to 1.3
- High8.2Arbitrary File Upload
Iptanus File Upload
<2.7.1Update to 2.7.1
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Ad Buttons
<2.3.2Update to 2.3.2
- High7.2Cross-Site Scripting via Comments
WordPress
≤4.2.1Update to 3.7.8 or 3.8.8 or 3.9.6 or 4.0.5 or 4.1.5 or 4.2.2
- Medium6.1Reflected Cross-Site Scripting
Simplr Registration Form Plus+
≤2.3.4Update to 2.3.5
- High8.8SQL Injection
Freshmail for WordPress
<1.6Update to 1.6
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Affiliate Ads for cbAds.com
<1.31Update to 1.31
- Medium6.1Cross-Site Scripting
Auberge
<1.4.5Update to 1.4.5
- Medium6.1Cross-Site Scripting
eShop
<6.3.12Update to 6.3.12
- Medium4.8Cross-Site Scripting
Affiliate Ads for cbAds.com
≤1.20Update to 1.35
- Medium6.1Cross-Site Scripting
Artificial Intelligence
<1.2.4Update to 1.2.4