CWE-434Vulnerability type

WordPress Arbitrary File Upload vulnerabilities (page 1344)

Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Arbitrary File Upload vulnerabilities (page 1344)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Cross-Site Scripting Contact Form Clean and Simple<4.4.1Update to 4.4.1	CVE-2014-8955	—	Nov 7, 2014
High7.2	Missing Authorization Smart Forms – when you need more than just a contact form≤2.1.0Update to 2.1.1	CVE-2014-8803	—	Nov 6, 2014
Medium6.1	Reflected Cross-Site Scripting WP Photo Album Plus≤5.4.17Update to 5.4.18	CVE-2014-8814	—	Nov 6, 2014
Medium6.1	Reflected Cross-Site Scripting Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤2.8.6Update to 2.8.7	CVE-2014-8815	—	Nov 6, 2014
Critical9.8	3.11 - SQL Injection Store Locator for WordPress with Google Maps – LotsOfLocales<3.12Update to 3.12	CVE-2014-8621	—	Nov 5, 2014
High7.2	Stored Cross-Site Scripting Contact Bank – Contact Form Builder for WordPress≤2.0.69Update to 2.0.70	CVE-2014-8807	—	Nov 5, 2014
Medium5.4	Cross-Site Scripting BulletProof Security<.51.1Update to .51.1	CVE-2014-7958	—	Nov 5, 2014
Medium4.3	Server-Side Request Forgery BulletProof Security≤.51Update to .51.1	CVE-2014-8749	—	Nov 5, 2014
Medium6.1	JavaScript Injection WP Support Plus Responsive Ticket System≤4.0Update to 4.1	CVE-2014-10391	—	Nov 4, 2014
Medium6.1	2.6 - Cross-Site Scripting post highlights2.0 – 2.6Update to 2.6.1	CVE-2014-8087	—	Nov 3, 2014
High7.5	Missing Authorization Database Backup for WordPress≤2.2.4Update to 2.3.0	CVE-2014-10076	—	Nov 2, 2014
Medium5.3	Sensitive Data Exposure Album and Image Gallery with Lightbox – Flagallery Photo Portfolio<4.25Update to 4.25	CVE-2014-8491	—	Oct 30, 2014
Medium6.1	Reflected Cross-Site Scripting User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor≤2.0.2Update to 2.0.3	CVE-2014-8492	—	Oct 30, 2014
Critical9.8	Arbitrary File Upload Creative Contact Form<1.0.0Update to 1.0.0	CVE-2014-8739	—	Oct 23, 2014
Critical9.8	SQL Injection CP Multi View Events Calendar<1.0.2Update to 1.0.2	CVE-2014-8586	—	Oct 23, 2014
Medium6.1	Cross-Site Scripting NEX-Forms Lite – WordPress Contact Form builder<3.4Update to 3.4	CVE-2014-7151	—	Oct 21, 2014
High8.8	Cross-Site Request Forgery Featured Comments<1.2.5Update to 1.2.5	CVE-2014-10382	—	Oct 21, 2014
Medium6.1	Reflected Cross-Site Scripting Gallery Bank – WordPress Photo Gallery Plugin<3.0.70Update to 3.0.70	CVE-2014-8758	—	Oct 18, 2014
High7.2	2.4 - Stored Cross-Site Scripting Contact Form Integrated With Google Maps1.0 – 2.4Update to 2.5	CVE-2014-7238	—	Oct 18, 2014
High7.5	Improper Access Control to Information Disclosure Backup, Restore and Migrate your sites with XCloner≤3.1.1Update to 3.1.2	CVE-2014-8605	—	Oct 17, 2014
High7.5	Sensitive Information Disclosure Backup, Restore and Migrate your sites with XCloner<3.1.2Update to 3.1.2	CVE-2014-8604	—	Oct 17, 2014
High7.2	Sensitive Information Disclosure Backup, Restore and Migrate your sites with XCloner<3.1.2Update to 3.1.2	CVE-2014-8607	—	Oct 17, 2014
Medium6.1	Stored Cross-Site Scripting Easy Contact Form Solution<1.7Update to 1.7	CVE-2014-7240	—	Oct 17, 2014
Medium4.9	Directory Traversal Backup, Restore and Migrate your sites with XCloner<3.1.2Update to 3.1.2	CVE-2014-8606	—	Oct 17, 2014
High7.2	Remote Code Execution Backup, Restore and Migrate your sites with XCloner<3.1.2Update to 3.1.2	CVE-2014-8603	—	Oct 17, 2014
Medium6.1	Cross-Site Scripting cformsII≤13.1Update to 13.2	CVE-2014-10377	—	Oct 16, 2014
High8.8	Cross-Site Request Forgery O2tweet≤0.0.4No patch available	CVE-2014-9338	—	Oct 15, 2014
Medium6.1	Cross-Site Scripting cforms≤10.1Update to 10.2	CVE-2014-10392	—	Oct 15, 2014
Medium6.1	Reflected Cross-Site Scripting WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator<6.0.27Update to 6.0.27	CVE-2014-7182	—	Oct 15, 2014
Medium6.1	Cross-Site Scripting cforms<10.5Update to 10.5	CVE-2014-10393	—	Oct 15, 2014

Medium6.1
Cross-Site Scripting
Contact Form Clean and Simple
<4.4.1Update to 4.4.1
CVE-2014-8955Nov 7, 2014
High7.2
Missing Authorization
Smart Forms – when you need more than just a contact form
≤2.1.0Update to 2.1.1
CVE-2014-8803Nov 6, 2014
Medium6.1
Reflected Cross-Site Scripting
WP Photo Album Plus
≤5.4.17Update to 5.4.18
CVE-2014-8814Nov 6, 2014
Medium6.1
Reflected Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤2.8.6Update to 2.8.7
CVE-2014-8815Nov 6, 2014
Critical9.8
3.11 - SQL Injection
Store Locator for WordPress with Google Maps – LotsOfLocales
<3.12Update to 3.12
CVE-2014-8621Nov 5, 2014
High7.2
Stored Cross-Site Scripting
Contact Bank – Contact Form Builder for WordPress
≤2.0.69Update to 2.0.70
CVE-2014-8807Nov 5, 2014
Medium5.4
Cross-Site Scripting
BulletProof Security
<.51.1Update to .51.1
CVE-2014-7958Nov 5, 2014
Medium4.3
Server-Side Request Forgery
BulletProof Security
≤.51Update to .51.1
CVE-2014-8749Nov 5, 2014
Medium6.1
JavaScript Injection
WP Support Plus Responsive Ticket System
≤4.0Update to 4.1
CVE-2014-10391Nov 4, 2014
Medium6.1
2.6 - Cross-Site Scripting
post highlights
2.0 – 2.6Update to 2.6.1
CVE-2014-8087Nov 3, 2014
High7.5
Missing Authorization
Database Backup for WordPress
≤2.2.4Update to 2.3.0
CVE-2014-10076Nov 2, 2014
Medium5.3
Sensitive Data Exposure
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
<4.25Update to 4.25
CVE-2014-8491Oct 30, 2014
Medium6.1
Reflected Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤2.0.2Update to 2.0.3
CVE-2014-8492Oct 30, 2014
Critical9.8
Arbitrary File Upload
Creative Contact Form
<1.0.0Update to 1.0.0
CVE-2014-8739Oct 23, 2014
Critical9.8
SQL Injection
CP Multi View Events Calendar
<1.0.2Update to 1.0.2
CVE-2014-8586Oct 23, 2014
Medium6.1
Cross-Site Scripting
NEX-Forms Lite – WordPress Contact Form builder
<3.4Update to 3.4
CVE-2014-7151Oct 21, 2014
High8.8
Cross-Site Request Forgery
Featured Comments
<1.2.5Update to 1.2.5
CVE-2014-10382Oct 21, 2014
Medium6.1
Reflected Cross-Site Scripting
Gallery Bank – WordPress Photo Gallery Plugin
<3.0.70Update to 3.0.70
CVE-2014-8758Oct 18, 2014
High7.2
2.4 - Stored Cross-Site Scripting
Contact Form Integrated With Google Maps
1.0 – 2.4Update to 2.5
CVE-2014-7238Oct 18, 2014
High7.5
Improper Access Control to Information Disclosure
Backup, Restore and Migrate your sites with XCloner
≤3.1.1Update to 3.1.2
CVE-2014-8605Oct 17, 2014
High7.5
Sensitive Information Disclosure
Backup, Restore and Migrate your sites with XCloner
<3.1.2Update to 3.1.2
CVE-2014-8604Oct 17, 2014
High7.2
Sensitive Information Disclosure
Backup, Restore and Migrate your sites with XCloner
<3.1.2Update to 3.1.2
CVE-2014-8607Oct 17, 2014
Medium6.1
Stored Cross-Site Scripting
Easy Contact Form Solution
<1.7Update to 1.7
CVE-2014-7240Oct 17, 2014
Medium4.9
Directory Traversal
Backup, Restore and Migrate your sites with XCloner
<3.1.2Update to 3.1.2
CVE-2014-8606Oct 17, 2014
High7.2
Remote Code Execution
Backup, Restore and Migrate your sites with XCloner
<3.1.2Update to 3.1.2
CVE-2014-8603Oct 17, 2014
Medium6.1
Cross-Site Scripting
cformsII
≤13.1Update to 13.2
CVE-2014-10377Oct 16, 2014
High8.8
Cross-Site Request Forgery
O2tweet
≤0.0.4No patch available
CVE-2014-9338Oct 15, 2014
Medium6.1
Cross-Site Scripting
cforms
≤10.1Update to 10.2
CVE-2014-10392Oct 15, 2014
Medium6.1
Reflected Cross-Site Scripting
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
<6.0.27Update to 6.0.27
CVE-2014-7182Oct 15, 2014
Medium6.1
Cross-Site Scripting
cforms
<10.5Update to 10.5
CVE-2014-10393Oct 15, 2014