CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 1356)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2013-7279 | — | |
| High8.8 | Cross-Site Request Forgery to Denial of Service | CVE-2013-7233 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-6993 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2013-7319 | — | |
| Critical9.8 | SQL Injection | CVE-2013-7187 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-7129 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-7419 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2013-7102 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2013-20002 | — | |
| Critical9.1 | Authentication Bypass | CVE-2013-4462 | — | |
| High7.1 | Cross-Site Request Forgery and to Cross-Site Scripting | CVE-2013-6797 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-6281 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2701 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-5978 | — | |
| Critical9.8 | SQL Injection | CVE-2013-6243 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2013-10027 | — | |
| Critical9.8 | Authentication Bypass | CVE-2013-3264 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3491 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3263 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-5916 | — | |
| Critical9.8 | SQL Injection | CVE-2013-5917 | — | |
| High7.2 | Cross-Site Scripting | CVE-2013-6010 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2013-5962 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2013-5963 | — | |
| Medium6.4 | HTML File Upload | CVE-2013-5738 | — | |
| Medium5.4 | Open Redirect | CVE-2013-4339 | — | |
| Medium6.3 | Spoof Post Authorship | CVE-2013-4340 | — | |
| Medium6.4 | .swf and .exe File Upload | CVE-2013-5739 | — | |
| High8.8 | Deserialization | CVE-2013-4338 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-5711 | — |
- Medium6.1Cross-Site Scripting
S3 Video Plugin
≤0.982Update to 0.983
- High8.8Cross-Site Request Forgery to Denial of Service
WordPress
≤2.0.11Update to 2.1
- Medium6.1Cross-Site Scripting
ad-minister
≤0.6No patch available
- High7.2Stored Cross-Site Scripting
Download Manager
≤2.5.8Update to 2.5.9
- Critical9.8SQL Injection
FormCraft
≤1.3.7Update to 1.3.8
- Medium6.1Cross-Site Scripting
Bloog
≤1.1Update to 1.2
- Medium6.1Reflected Cross-Site Scripting
JS Multi Hotel
≤2.2.1No patch available
- Critical9.8Arbitrary File Upload
OptimizePress
<1.6Update to 1.6
- Critical9.8Arbitrary File Upload
Elemin
<1.4.3Update to 1.4.3
- Critical9.1Authentication Bypass
Portable phpMyAdmin
≤1.5.0No patch available
- High7.1Cross-Site Request Forgery and to Cross-Site Scripting
Blue Wrench Video Widget
≤1.0.5Update to 2.0.0
- Medium6.1Cross-Site Scripting
dhtmlxspreadsheet
≤2.0No patch available
- High8.8Cross-Site Request Forgery
Social Sharing Toolkit
≤2.1.1Update to 2.1.2
- Medium6.1Cross-Site Scripting
Cart66 Lite :: WordPress Ecommerce
<1.5.1.15Update to 1.5.1.15
- Critical9.8SQL Injection
WordPress Landing Pages
<1.2.3Update to 1.2.3
- Medium4.3Cross-Site Request Forgery
Blogger Importer
≤0.5Update to 0.6
- Critical9.8Authentication Bypass
WP Ultimate Email Marketer
≤1.2.0No patch available
- Medium6.1Cross-Site Scripting
Sharebar
≤1.4.2Update to 1.4.3
- Medium6.1Cross-Site Scripting
WP Ultimate Email Marketer
≤1.2.0No patch available
- Medium6.1Cross-Site Scripting
Bradesco Gateway
≤2.0No patch available
- Critical9.8SQL Injection
NOSpamPTI
≤2.1No patch available
- High7.2Cross-Site Scripting
Comment Attachment
≤1.5.5No patch available
- Critical9.8Arbitrary File Upload
Complete Gallery Manager for WordPress | Galleries
<3.3.4Update to 3.3.4
- Critical9.8Arbitrary File Upload
Simple Dropbox Upload
<1.8.8.1Update to 1.8.8.1
- Medium6.4HTML File Upload
WordPress
≤3.6Update to 3.6.1
- Medium5.4Open Redirect
WordPress
≤3.6Update to 3.6.1
- Medium6.3Spoof Post Authorship
WordPress
≤3.6Update to 3.6.1
- Medium6.4.swf and .exe File Upload
WordPress
<3.6.1Update to 3.6.1
- High8.8Deserialization
WordPress
≤3.6Update to 3.6.1
- Medium6.1Cross-Site Scripting
Design Approval System
≤3.6Update to 3.7