CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 1348)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2012-20003 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-3256 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-100007 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4854 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-5329 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-6342 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4578 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2013-2287 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2014-4725 | — | |
| High8.8 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2013-2710 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-2550 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2014-1888 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2699 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2706 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-3870 | — | |
| Critical9.8 | Local/Remote File Inclusion | CVE-2013-7483 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2013-10026 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2007-2484 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-10378 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2013-4954 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-0895 | — | |
| Medium4.7 | Cross-Site Request Forgery | CVE-2013-2705 | — | |
| Critical9.8 | Remote Code Execution | CVE-2013-2010 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2013-3476 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4856 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4581 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3261 | — | |
| Critical9.8 | Unrestricted File Upload | CVE-2014-4972 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-3923 | — | |
| High8.8 | SQL Injection | CVE-2012-5327 | — |
- Medium6.1Reflected Cross-Site Scripting
custom-tables
≤3.4.4No patch available
- High8.8Cross-Site Request Forgery
sexybookmarks
≤6.1.4.0Update to 6.1.5.0
- Medium6.1Cross-Site Scripting
HK Exif Tags
≤1.11Update to 1.12
- Medium6.1Cross-Site Scripting
WP Construction Mode
≤1.8Update to 1.9
- Medium6.1Reflected Cross-Site Scripting
Redirection
<2.2.9Update to 2.2.9
- Medium6.1Cross-Site Scripting
Tweet Blender
≤4.0.1Update to 4.0.2
- Medium6.1Reflected Cross-Site Scripting
WP App Maker
≤1.0.16.4No patch available
- Medium6.1Multiple Cross-Site Scripting
Uploader
≤1.0.4No patch available
- Critical9.8Arbitrary File Upload
MailPoet Newsletters (Previous)
≤2.6.6Update to 2.6.7
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Contextual Related Posts
≤1.8.6Update to 1.8.7
- High8.8Cross-Site Request Forgery
Disable Comments
<1.0.4Update to 1.0.4
- Medium6.4Stored Cross-Site Scripting
BuddyPress
≤1.9.1Update to 1.9.2
- High8.8Cross-Site Request Forgery
underConstruction
<1.09Update to 1.09
- High8.8Cross-Site Request Forgery
Stream Video Player
≤1.4.1No patch available
- Medium6.1Cross-Site Scripting
bib2html
≤0.9.3No patch available
- Critical9.8Local/Remote File Inclusion
SlideDeck 2 Lite Responsive Content Slider
≤2.3.3Update to 2.3.5
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Mail Subscribe List
≤2.0.9Update to 2.1
- Critical9.8Remote File Inclusion
WP-Table
≤1.43Update to 1.44
- Medium6.1Cross-Site Scripting
Yoast Duplicate Post
≤2.6Update to 3.0
- Medium6.1Multiple Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction
≤1.30Update to 1.31
- Medium6.1Cross-Site Scripting
Count per Day
≤3.1Update to 3.1.1
- Medium4.7Cross-Site Request Forgery
Simple Shopping Cart
<3.6Update to 3.6
- Critical9.8Remote Code Execution
W3 Total Cache
≤0.9.2.8Update to 0.9.2.9
- Medium4.3Cross-Site Request Forgery
WordPress Related Posts
<2.7.2Update to 2.7.2
- Medium6.1Cross-Site Scripting
Crowdsignal Dashboard – Polls, Surveys & more
≤2.0.24Update to 2.0.25
- Medium6.1Reflected Cross-Site Scripting
WPCB
≤2.4.8No patch available
- Medium6.1Cross-Site Scripting
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
≤2.71Update to 2.72
- Critical9.8Unrestricted File Upload
gravity-file-ajax-upload-free
≤1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
DZS Video Gallery
<7.95Update to 7.95
- High8.8SQL Injection
Mingle Forum
≤1.0.32.1Update to 1.0.33