CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 1339)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8SQL Injection
Contact Form, Drag and Drop Form Builder Plugin – Live Forms
<3.2.0Update to 3.2.0
- Medium6.1Cross-Site Scripting
wpml
<3.1.9Update to 3.1.9
- High7.5Arbitrary Deletion of Content
WPML Multilingual CMS
≤3.1.9Update to 3.1.9.1
- High7.5Cross-Site Request Forgery
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤1.7.3.3Update to 1.5.7 or 1.6.4 or 1.7.4
- Critical9.8SQL Injection via lang Parameter
WPML Multilingual CMS
≤3.1.9Update to 3.1.9.1
- Critical9.8Arbitrary File Upload
WPshop 2 – E-Commerce
<1.3.9.6Update to 1.3.9.6
- Medium4.9Authenticated (Admin+) Path Traversal
IP Blacklist Cloud
≤3.42Update to 3.43
- Low3.1Cross-Site Request Forgery
All-In-One Security (AIOS) – Security and Firewall
≤3.8.9Update to 3.9.0
- Critical9.0SQL Injection
All-In-One Security (AIOS) – Security and Firewall
<3.8.8Update to 3.8.8
- Medium4.3Cross-site request forgery via a request in the CF7DBPluginSubmissions page to wp-admin/admin.php
Contact Form DB
≤2.8.29Update to 2.8.32
- Critical9.8Arbitrary File Upload
DesignFolio Pllus
all versionsNo patch available
- Medium5.3CAPTCHA Bypass
reCaptcha by BestWebSoft
<1.13Update to 1.13
- Medium5.4Authorization Bypass
WPML Multilingual CMS
<3.1.9Update to 3.1.9.1
- Medium6.1Reflected Cross-Site Scripting
WP All Import Pro
≤4.1.1Update to 4.1.2
- High8.83.0.20 - Privilege Escalation
WP EasyCart: Shopping Cart and eCommerce Store
1.1.30 – 3.0.20Update to 3.0.21
- Medium6.1Cross-Site Scripting
WP Media Cleaner
≤2.2.6Update to 2.4.0
- Medium6.5Authenticated Cross-Site Scripting
Contact Form DB
≤2.8.26Update to 2.8.28
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Easy Social Icons
≤1.2.2Update to 1.2.3
- High8.8Blind SQL Injection
WonderPlugin Audio Player
≤2.0Update to 2.1
- High7.1Multiple Cross-Site Scripting
WonderPlugin Audio Player
<2.1Update to 2.1
- High8.2Arbitrary Backup Creation and Download
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
<0.5.10Update to 0.5.10
- Medium5.4Reflected Cross Site Scripting
Image Metadata Cruncher
≤1.8No patch available
- Medium6.1Reflected Cross-Site Scripting
PlusCaptcha
≤2.0.6Update to 2.0.14
- Critical9.8Unauthenticated SQL Injection
SpiderCalendar
<1.4.10Update to 1.4.10
- High8.8Arbitrary File Upload
Fusion
≤3.1No patch available
- Critical9.8Unauthenticated SQL Injection
CP Appointment Calendar
≤1.1.5Update to 1.1.6
- High8.8Unrestricted File Upload
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.2.6Update to 1.2.6
- Critical9.8SQL Injection
WORDPRESS VIDEO GALLERY
<2.8Update to 2.8
- High7.5Brute Force Password Recovery Tokens
WordPress
<4.4Update to 4.4
- Medium6.1Cross-Site Request Forgery and Stored Cross-Site Scripting
Mobile Domain
≤1.5.2No patch available