VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-434Vulnerability type

WordPress Arbitrary File Upload vulnerabilities (page 1347)

Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.

Severity
Signals
Software

41,172 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Arbitrary File Upload vulnerabilities (page 1347)
SeverityVulnerabilityCVEInstallsPublished
Medium5.3XML External Entity (XXE) Weakness
WordPress<3.9.2Update to 3.9.2
CVE-2014-2053—
Low2.7Denial of Service via XML
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-5265—
Critical9.8SQL Injection
WordPress Spreadsheet≤0.62No patch available
CVE-2014-8363—
Medium6.5Brute Force of Cross-Site Request Forgery Tokens
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-5205—
Medium6.5Denial of Service via XML #2
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-5266—
High7.2Deserialization via Widgets
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-5203—
High8.8Cross-Site Request Forgery to Authentication Takeover
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-9033—
Medium6.1Reflected Cross-Site Scripting
custom-tables≤3.4.4No patch available
CVE-2012-20003—
Medium6.4Stored Cross-Site Scripting
BuddyPress≤1.9.1Update to 1.9.2
CVE-2014-1888—
Medium6.1Cross-Site Scripting
BulletProof Security≤.48.9Update to .49
CVE-2013-3487—
Medium6.3Cross-Site Request Forgery
WordPress Content Slide≤1.4.2No patch available
CVE-2013-2708—
Critical9.8Unauthenticated Command Injection
EZPZ One Click Backup≤12.03.10No patch available
CVE-2014-3114—
Critical9.8Remote Code Execution
WP Super Cache<1.3.2Update to 1.3.2
CVE-2013-2011—
Medium6.1Unauthenticated Stored Cross-Site Scripting
Mail Subscribe List≤2.0.9Update to 2.1
CVE-2013-10026—
High8.8Cross-Site Request Forgery
Xhanch – My Twitter≤2.7.6Update to 2.7.7
CVE-2013-3253—
Medium6.1Cross-Site Scripting
bib2html≤0.9.3No patch available
CVE-2014-3870—
Medium6.1Reflected Cross-Site Scripting
WP App Maker≤1.0.16.4No patch available
CVE-2014-4578—
Critical9.8Arbitrary File Upload
MailPoet Newsletters (Previous)≤2.6.6Update to 2.6.7
CVE-2014-4725—
High8.8Cross-Site Request Forgery
Stream Video Player≤1.4.1No patch available
CVE-2013-2706—
Medium6.1Cross-Site Scripting
Count per Day≤3.1.1Update to 3.2
CVE-2012-3434—
High8.8Cross-Site Request Forgery
sexybookmarks≤6.1.4.0Update to 6.1.5.0
CVE-2013-3256—
Medium5.3Cross-Site Scripting
Redirection<2.2.10Update to 2.2.10
CVE-2011-4562—
Medium6.1Cross-Site Scripting
Tweet Blender≤4.0.1Update to 4.0.2
CVE-2013-6342—
Medium6.1Multiple Cross-Site Scripting
Uploader≤1.0.4No patch available
CVE-2013-2287—
Medium6.1Reflected Cross-Site Scripting
Redirection<2.2.9Update to 2.2.9
CVE-2011-5329—
Medium5.3Information Disclosure
Portable phpMyAdmin≤1.4.1No patch available
CVE-2013-4454—
Medium6.1Cross-Site scripting
Hot Files: File Sharing and Download Manager Plugin≤1.0.0No patch available
CVE-2014-4588—
Medium5.3Full Path Disclosure
WP PHP widget≤1.0.2No patch available
CVE-2013-0721—
High7.1Cross-Site Scripting
Polylang<1.5.2Update to 1.5.2
CVE-2014-4855—
High8.8Cross-Site Request Forgery
Disable Comments<1.0.4Update to 1.0.4
CVE-2014-2550—

Search VulnCrest Radar

Jump to

Are you sure?