CWE-434Vulnerability type

WordPress Arbitrary File Upload vulnerabilities (page 1336)

Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Arbitrary File Upload vulnerabilities (page 1336)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Cross-Site Scripting Easy Digital Downloads – eCommerce Payments and Subscriptions made easy≤2.3.6Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7	CVE-2015-9512	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads (EDD) Digital Store<1.3.3Update to 1.3.3	CVE-2015-9532	—	Apr 20, 2015
Medium5.3	Reflected Cross Site Scripting Broken Link Checker<1.10.6Update to 1.10.6	CVE-2015-10098	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting ithemes-exchange<1.12.0Update to 1.12.0	CVE-2015-9363	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – PDF stamper≤1.0No patch available	CVE-2015-9519	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting WP-ViperGB<1.3.16Update to 1.3.16	CVE-2015-9356	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting exchange-addon-table-rate-shipping<1.1.0Update to 1.1.0	CVE-2015-9375	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – Conditional Success Redirects<1.1.1Update to 1.1.1	CVE-2015-9511	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Exchange Addon Invoices<1.4.0Update to 1.4.0	CVE-2015-9370	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Authorize.net Add-on for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9365	—	Apr 20, 2015
Critical9.8	SQL Injection Community Events≤1.3Update to 1.4	CVE-2015-3313	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Mobile<1.2.8Update to 1.2.8	CVE-2015-9376	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting iThemes Builder Style Manager<0.7.7Update to 0.7.7	CVE-2015-9379	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – Invoices≤1.0.3Update to 1.0.4	CVE-2015-9516	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads - QR Codes≤1.1.0Update to 1.1.1	CVE-2015-9522	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads - Wish Lists≤1.1Update to 1.1.1	CVE-2015-9531	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads - Free Downloads≤2.3.6Update to 2.3.7	CVE-2015-9514	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy US Sales Taxes Add-on for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9369	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Exchange Addon Membership<1.3.0Update to 1.3.0	CVE-2015-9372	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Market<5.1.27Update to 5.1.27	CVE-2015-9378	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting 2Checkout Add-on for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9364	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – eCommerce Payments and Subscriptions made easy<2.3.7Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7	CVE-2015-9505	—	Apr 20, 2015
Medium6.1	Cross-Sell and Upsell <= 1.1.2 - Reflected Cross-Site Scripting Easy Digital Downloads - Cross-Sell and Upsell≤1.1.2Update to 1.1.3	CVE-2015-9510	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads – Manual Purchases<1.9.1Update to 1.9.1	CVE-2015-9517	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads - Amazon S3≤2.1.3Update to 2.1.4	CVE-2015-9506	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Shoppette<1.0.5Update to 1.0.5	CVE-2015-9535	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads - Product Reviews≤1.3.8Update to 1.3.10	CVE-2015-9526	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads – Pushover notifications≤1.2.8Update to 1.2.9	CVE-2015-9521	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Manual Purchases Add-on for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9371	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads - Recurring Payments≤2.3Update to 2.3.1	CVE-2015-9525	—	Apr 20, 2015

Medium6.1
Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.3.6Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7
CVE-2015-9512Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads (EDD) Digital Store
<1.3.3Update to 1.3.3
CVE-2015-9532Apr 20, 2015
Medium5.3
Reflected Cross Site Scripting
Broken Link Checker
<1.10.6Update to 1.10.6
CVE-2015-10098Apr 20, 2015
Medium6.1
Cross-Site Scripting
ithemes-exchange
<1.12.0Update to 1.12.0
CVE-2015-9363Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – PDF stamper
≤1.0No patch available
CVE-2015-9519Apr 20, 2015
Medium6.1
Cross-Site Scripting
WP-ViperGB
<1.3.16Update to 1.3.16
CVE-2015-9356Apr 20, 2015
Medium6.1
Cross-Site Scripting
exchange-addon-table-rate-shipping
<1.1.0Update to 1.1.0
CVE-2015-9375Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – Conditional Success Redirects
<1.1.1Update to 1.1.1
CVE-2015-9511Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Exchange Addon Invoices
<1.4.0Update to 1.4.0
CVE-2015-9370Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Authorize.net Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9365Apr 20, 2015
Critical9.8
SQL Injection
Community Events
≤1.3Update to 1.4
CVE-2015-3313Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Mobile
<1.2.8Update to 1.2.8
CVE-2015-9376Apr 20, 2015
Medium6.1
Cross-Site Scripting
iThemes Builder Style Manager
<0.7.7Update to 0.7.7
CVE-2015-9379Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – Invoices
≤1.0.3Update to 1.0.4
CVE-2015-9516Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads - QR Codes
≤1.1.0Update to 1.1.1
CVE-2015-9522Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads - Wish Lists
≤1.1Update to 1.1.1
CVE-2015-9531Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads - Free Downloads
≤2.3.6Update to 2.3.7
CVE-2015-9514Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy US Sales Taxes Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9369Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Exchange Addon Membership
<1.3.0Update to 1.3.0
CVE-2015-9372Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Market
<5.1.27Update to 5.1.27
CVE-2015-9378Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
2Checkout Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9364Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
<2.3.7Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7
CVE-2015-9505Apr 20, 2015
Medium6.1
Cross-Sell and Upsell <= 1.1.2 - Reflected Cross-Site Scripting
Easy Digital Downloads - Cross-Sell and Upsell
≤1.1.2Update to 1.1.3
CVE-2015-9510Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads – Manual Purchases
<1.9.1Update to 1.9.1
CVE-2015-9517Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads - Amazon S3
≤2.1.3Update to 2.1.4
CVE-2015-9506Apr 20, 2015
Medium6.1
Cross-Site Scripting
Shoppette
<1.0.5Update to 1.0.5
CVE-2015-9535Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads - Product Reviews
≤1.3.8Update to 1.3.10
CVE-2015-9526Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads – Pushover notifications
≤1.2.8Update to 1.2.9
CVE-2015-9521Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Manual Purchases Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9371Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads - Recurring Payments
≤2.3Update to 2.3.1
CVE-2015-9525Apr 20, 2015