CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 1352)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.1 | Cross-Site Scripting | CVE-2014-4540 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4604 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2014-5182 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4558 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4538 | — | |
| High8.8 | SQL Injection | CVE-2014-5185 | — | |
| High7.5 | Directory Traversal | CVE-2014-4940 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2014-4526 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2014-4939 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4597 | — | |
| High7.5 | Path Traversal | CVE-2014-4937 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4524 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4554 | — | |
| High7.2 | SQL Injection | CVE-2014-5184 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4514 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4520 | — | |
| High7.2 | Authenticated SQL Injection | CVE-2014-5186 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4574 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4547 | — | |
| High7.5 | Server-Side Request Forgery | CVE-2014-9292 | — | |
| Medium5.3 | Directory Traversal | CVE-2014-5181 | — | |
| Critical9.1 | Authenticated (Admin+) SQL Injection | CVE-2014-5180 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4527 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4576 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4545 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4522 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4583 | — | |
| Medium6.1 | CBI Referral Manager <= 1.2.1 Cross-Site Scripting | CVE-2014-4517 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4542 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4552 | — |
- High7.1Cross-Site Scripting
Oleggo LiveStream
≤0.2.6No patch available
- Medium6.1Cross-Site Scripting
your-text-manager
≤0.3.0No patch available
- High8.8Authenticated SQL Injection
YAWPP (Yet Another WordPress Petition Plugin)
≤1.2.1Update to 1.2.2
- Medium6.1Reflected Cross-Site Scripting
swipehq-payment-gateway-woocommerce
≤2.7.1No patch available
- High7.1Cross-Site Scripting
Malware Finder
≤1.1No patch available
- High8.8SQL Injection
quartz
≤1.01.1No patch available
- High7.5Directory Traversal
Tera Charts
≤0.1Update to 1.0
- Medium6.1Multiple Cross-Site Scripting
efence
≤1.3.2No patch available
- High7.2Authenticated (Admin+) SQL Injection
ENL Newsletter
≤1.0.1No patch available
- Medium6.1Reflected Cross-Site Scripting
WordPress Social Invitations – Lite
≤1.4.4.2Update to 1.4.4.3
- High7.5Path Traversal
BookX
≤1.7No patch available
- Medium6.1Cross-Site Scripting
WP Easy Post Types
<1.4.4Update to 1.4.4
- Medium6.1Cross-Site Scripting
SS Downloads
≤1.4.4.1Update to 1.5
- High7.2SQL Injection
stripshow
≤2.5.2No patch available
- Medium6.1Cross-Site Scripting
WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件
<3.7.0Update to 3.7.0
- Medium6.1Cross-Site Scripting
DMCA WaterMarker
<1.1Update to 1.1
- High7.2Authenticated SQL Injection
All Video Gallery Plugin for WordPress
≤1.2No patch available
- Medium6.1Cross-Site Scripting
WebEngage Feedback, Survey and Notification
<2.0.1Update to 2.0.1
- Medium6.1Cross-Site Scripting
Rezgo Online Booking
<1.8.2Update to 1.8.2
- High7.5Server-Side Request Forgery
jRSS Widget
≤1.2No patch available
- Medium5.3Directory Traversal
lastfm-rotation
≤1.0No patch available
- Critical9.1Authenticated (Admin+) SQL Injection
HDW Player Plugin (Video Player & Video Gallery)
≤2.4.2Update to 3.0
- Medium6.1Cross-Site Scripting
EnvíaloSimple: Email Marketing y Newsletters
≤1.97Update to 1.98
- Medium6.1Cross-Site Scripting
WordPress Social Login
≤2.1.5Update to 2.1.6
- Medium6.1Cross-Site Scripting
proquoter
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
dsSearchAgent: WordPress Edition
<1.0-beta10No patch available
- Medium6.1Cross-Site Scripting
WP-Contact
≤1.0No patch available
- Medium6.1CBI Referral Manager <= 1.2.1 Cross-Site Scripting
CBI Referral Manager
≤1.2.1No patch available
- Medium6.1Reflected Cross-Site Scripting
ooorl
≤1.0.0No patch available
- Medium6.1Cross-Site Scripting
Spotlight
≤4.7No patch available