CWE-434Vulnerability type

WordPress Arbitrary File Upload vulnerabilities (page 1357)

Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Arbitrary File Upload vulnerabilities (page 1357)
Severity	Vulnerability	CVE	Installs	Published
High8.8	Cross-Site Request Forgery Testimonial<2.3Update to 2.3	CVE-2013-5672	—	Sep 1, 2013
Critical9.8	SQL Injection Testimonial<2.3Update to 2.3	CVE-2013-5673	—	Sep 1, 2013
Medium6.1	Cross-Site Scripting Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress≤3.34Update to 3.35	CVE-2013-7481	—	Aug 26, 2013
Medium6.1	Reflected Cross-Site Scripting Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP≤4.25.3Update to 4.27	CVE-2013-5714	—	Aug 23, 2013
Medium6.1	Cross-Site Scripting BackWPup – WordPress Backup & Restore Plugin<3.0.13Update to 3.0.13	CVE-2013-4626	—	Aug 21, 2013
Medium6.1	Reflected Cross-Site Scripting A Forms≤1.4.2Update to 1.4.3	CVE-2013-10020	—	Aug 19, 2013
Medium6.1	Cross-Site Scripting Events Manager – Calendar, Bookings, Tickets, Appointments and more!<5.5Update to 5.5	CVE-2013-7478	—	Aug 14, 2013
Medium6.1	Cross-Site Scripting Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress≤3.51Update to 3.52	CVE-2013-7475	—	Aug 13, 2013
Medium6.1	Cross-Site Scripting HMS Testimonials<2.0.11Update to 2.0.11	CVE-2013-4241	—	Aug 8, 2013
High7.1	Cross-Site Request Forgery HMS Testimonials<2.0.11Update to 2.0.11	CVE-2013-4240	—	Aug 8, 2013
High7.2	Cross-Site Scripting via sort Parameter Download Monitor<3.3.6.2Update to 3.3.6.2	CVE-2013-5098	—	Jul 23, 2013
Medium6.1	Cross-Site Scripting via p Parameter Download Monitor<3.3.6.2Update to 3.3.6.2	CVE-2013-3262	—	Jul 22, 2013
Medium6.1	Reflected Cross-Site Scripting Category Grid View Gallery≤2.3.1Update to 2.3.2	CVE-2013-4117	—	Jul 12, 2013
Medium6.1	Cross-Site Scripting BuddyPress Extended Friendship Request<1.0.2Update to 1.0.2	CVE-2013-4944	—	Jul 3, 2013
Medium6.1	DOM Cross-Site Scripting Xorbin Digital Flash Clock≤1.0No patch available	CVE-2013-4693	—	Jun 30, 2013
High8.8	Cross-Site Request Forgery qTranslate≤2.5.39No patch available	CVE-2013-3251	—	Jun 23, 2013
Medium5.3	Denial of Service via wp-postpass cookie WordPress<3.5.2Update to 3.5.2	CVE-2013-2173	—	Jun 21, 2013
Medium6.4	Cross-Site Scripting WordPress≤3.5.1Update to 3.5.2	CVE-2013-2205	—	Jun 21, 2013
Medium5.4	Server Side Request Forgery WordPress≤3.5.1Update to 3.5.2	CVE-2013-2199	—	Jun 21, 2013
Medium6.4	Cross-Site Scripting via Multiple Vectors WordPress≤3.5.1Update to 3.5.2	CVE-2013-2201	—	Jun 21, 2013
Medium5.4	XXE Injection WordPress≤3.5.1Update to 3.5.2	CVE-2013-2202	—	Jun 21, 2013
Medium4.6	Content-Spoofing Attacks WordPress≤3.5.1Update to 3.5.2	CVE-2013-2204	—	Jun 21, 2013
Medium6.3	Missing Authorization Checks WordPress≤3.5.1Update to 3.5.2	CVE-2013-2200	—	Jun 21, 2013
Medium4.3	Sensitive Information Disclosure WordPress≤3.5.1Update to 3.5.2	CVE-2013-2203	—	Jun 21, 2013
Critical9.8	Arbitrary File Upload Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery≤1.9.12Update to 1.9.13	CVE-2013-3684	—	Jun 13, 2013
Medium5.4	Missing Authorization Checks & Cross-Site Request Forgery LightStart – Maintenance Mode, Coming Soon and Landing Page Builder<1.8.8Update to 1.8.8	CVE-2013-3250	—	Jun 5, 2013
Medium5.3	Full Path Dislcosure WordPress Exit Box Lite1.06 – 1.06Update to 1.10	CVE-2013-10030	—	May 28, 2013
Medium4.3	Cross-Site Request Forgery WordPress Exit Box Lite≤1.06Update to 1.10	CVE-2013-10029	—	May 28, 2013
Medium5.3	Information Exposure WordPress Exit Strategy≤1.55Update to 1.59	CVE-2013-10024	—	May 28, 2013
Medium4.3	Cross-Site Request Forgery WordPress Exit Strategy≤1.55Update to 1.59	CVE-2013-10025	—	May 28, 2013

High8.8
Cross-Site Request Forgery
Testimonial
<2.3Update to 2.3
CVE-2013-5672Sep 1, 2013
Critical9.8
SQL Injection
Testimonial
<2.3Update to 2.3
CVE-2013-5673Sep 1, 2013
Medium6.1
Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
≤3.34Update to 3.35
CVE-2013-7481Aug 26, 2013
Medium6.1
Reflected Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤4.25.3Update to 4.27
CVE-2013-5714Aug 23, 2013
Medium6.1
Cross-Site Scripting
BackWPup – WordPress Backup & Restore Plugin
<3.0.13Update to 3.0.13
CVE-2013-4626Aug 21, 2013
Medium6.1
Reflected Cross-Site Scripting
A Forms
≤1.4.2Update to 1.4.3
CVE-2013-10020Aug 19, 2013
Medium6.1
Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.5Update to 5.5
CVE-2013-7478Aug 14, 2013
Medium6.1
Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
≤3.51Update to 3.52
CVE-2013-7475Aug 13, 2013
Medium6.1
Cross-Site Scripting
HMS Testimonials
<2.0.11Update to 2.0.11
CVE-2013-4241Aug 8, 2013
High7.1
Cross-Site Request Forgery
HMS Testimonials
<2.0.11Update to 2.0.11
CVE-2013-4240Aug 8, 2013
High7.2
Cross-Site Scripting via sort Parameter
Download Monitor
<3.3.6.2Update to 3.3.6.2
CVE-2013-5098Jul 23, 2013
Medium6.1
Cross-Site Scripting via p Parameter
Download Monitor
<3.3.6.2Update to 3.3.6.2
CVE-2013-3262Jul 22, 2013
Medium6.1
Reflected Cross-Site Scripting
Category Grid View Gallery
≤2.3.1Update to 2.3.2
CVE-2013-4117Jul 12, 2013
Medium6.1
Cross-Site Scripting
BuddyPress Extended Friendship Request
<1.0.2Update to 1.0.2
CVE-2013-4944Jul 3, 2013
Medium6.1
DOM Cross-Site Scripting
Xorbin Digital Flash Clock
≤1.0No patch available
CVE-2013-4693Jun 30, 2013
High8.8
Cross-Site Request Forgery
qTranslate
≤2.5.39No patch available
CVE-2013-3251Jun 23, 2013
Medium5.3
Denial of Service via wp-postpass cookie
WordPress
<3.5.2Update to 3.5.2
CVE-2013-2173Jun 21, 2013
Medium6.4
Cross-Site Scripting
WordPress
≤3.5.1Update to 3.5.2
CVE-2013-2205Jun 21, 2013
Medium5.4
Server Side Request Forgery
WordPress
≤3.5.1Update to 3.5.2
CVE-2013-2199Jun 21, 2013
Medium6.4
Cross-Site Scripting via Multiple Vectors
WordPress
≤3.5.1Update to 3.5.2
CVE-2013-2201Jun 21, 2013
Medium5.4
XXE Injection
WordPress
≤3.5.1Update to 3.5.2
CVE-2013-2202Jun 21, 2013
Medium4.6
Content-Spoofing Attacks
WordPress
≤3.5.1Update to 3.5.2
CVE-2013-2204Jun 21, 2013
Medium6.3
Missing Authorization Checks
WordPress
≤3.5.1Update to 3.5.2
CVE-2013-2200Jun 21, 2013
Medium4.3
Sensitive Information Disclosure
WordPress
≤3.5.1Update to 3.5.2
CVE-2013-2203Jun 21, 2013
Critical9.8
Arbitrary File Upload
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤1.9.12Update to 1.9.13
CVE-2013-3684Jun 13, 2013
Medium5.4
Missing Authorization Checks & Cross-Site Request Forgery
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<1.8.8Update to 1.8.8
CVE-2013-3250Jun 5, 2013
Medium5.3
Full Path Dislcosure
WordPress Exit Box Lite
1.06 – 1.06Update to 1.10
CVE-2013-10030May 28, 2013
Medium4.3
Cross-Site Request Forgery
WordPress Exit Box Lite
≤1.06Update to 1.10
CVE-2013-10029May 28, 2013
Medium5.3
Information Exposure
WordPress Exit Strategy
≤1.55Update to 1.59
CVE-2013-10024May 28, 2013
Medium4.3
Cross-Site Request Forgery
WordPress Exit Strategy
≤1.55Update to 1.59
CVE-2013-10025May 28, 2013