CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 134)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
CoolClock
≤4.3.7Update to 4.3.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
EventON – Events Calendar
≤2.5.7Update to 2.5.8
- Medium6.5Authenticated (Subscriber+) Arbitrary File Read
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
≤1.3.7No patch available
- High7.36.3.0 - Missing Authorization to Unauthenticated Arbitrary Option Deletion
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
≤19.2Update to 19.3 or 6.3.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting
Graphina – Charts and Graphs For Elementor
≤3.1.11Update to 3.1.12
- High7.3Unauthenticated Privilege Escalation
CatalogX Product Catalog, Product Enquiry & Quotes for WooCommerce
≤6.1.5Update to 6.1.6
- Medium5.3Unauthenticated Insecure Direct Object Reference
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.6.0Update to 5.6.4
- Medium5.3Missing Authorization
Hungarian Pickup Points & Shipping Labels for WooCommerce
<4.2.8Update to 4.2.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Open User Map – Interactive Leaflet Maps
≤1.4.50Update to 1.4.51
- Medium4.3Missing Authorization
Unbounce Landing Pages
≤1.1.4Update to 1.1.5
- High7.2Unauthenticated Stored Cross-Site Scripting
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.5.1Update to 3.6.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Easy Appointments
≤4.0.2.1No patch available
- High7.2Unauthenticated Server-Side Request Forgery
Hide My WP Ghost – Security & Firewall
≤7.0.09Update to 7.0.10
- High7.5Unauthenticated Denial of Service
WooCommerce
<11.1.0Update to 11.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.17Update to 2.0.18
- High7.5Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter
WP Fusion (Pro)
≤3.47.13Update to 3.47.14
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤5.9.27Update to 5.9.28
- High7.5Unauthenticated SQL Injection
Music Store – WordPress eCommerce
<1.4.5Update to 1.4.5
- High7.1Authenticated (Subscriber+) Arbitrary Options Deletion via Missing Authorization on 'delete' Parameter
EDD Product Catalog Feed by PixelYourSite
≤1.0.2Update to 1.0.3
- High8.8Authenticated (Contributor+) PHP Object Injection via Shortcode
Live Composer – Free WordPress Website Builder
≤2.1.18Update to 2.1.19
- Medium5.3Unauthenticated Payment Bypass
WP Express Checkout (Fast Payments via PayPal & Stripe)
≤2.4.0Update to 2.5.0
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter
Zephyr Project Manager
≤3.3.205Update to 3.3.206
- Medium6.5Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’
WPML Multilingual CMS
≤4.9.5Update to 4.9.6
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Beaver Builder Page Builder – Drag and Drop Website Builder
≤2.10.3.1Update to 2.10.3.2
- High7.5Unauthenticated SQL Injection
ELEX WooCommerce Request a Quote
≤2.4.0Update to 2.4.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.3.9.1Update to 4.4.0
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update
Online Scheduling and Appointment Booking System – Bookly
≤27.2Update to 27.3
- Medium5.33.5.2 - Unauthenticated Ticket Attachment Read
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
3.2.9 – 3.5.2Update to 3.5.3
- Medium4.3Missing Authorization
Ultimate Gift Cards for WooCommerce
≤3.2.9Update to 3.2.10
- Medium6.1Reflected Cross-Site Scripting
IPGP Visitors Origin
<1.6Update to 1.6