CWE-434Vulnerability type

WordPress Arbitrary File Upload vulnerabilities (page 1362)

Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Arbitrary File Upload vulnerabilities (page 1362)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Cross-Site Scripting Events Manager – Calendar, Bookings, Tickets, Appointments and more!<5.1.7Update to 5.1.7	CVE-2012-6716	—	May 22, 2012
High7.2	Cross-Site Scripting Share and Follow≤1.80.3Update to 1.80.4	CVE-2012-2917	—	May 21, 2012
Medium6.1	Cross-Site Scripting AJAX Auth – Fast Logins, 2FA, Redirects≤3.0.4Update to 3.0.4.1	CVE-2012-2759	—	May 18, 2012
Medium6.1	Cross-Site Scripting SoundCloud Is Gold≤2.2Update to 2.2.1	CVE-2012-6624	—	May 15, 2012
Medium6.1	Cross-Site Scripting Sharebar≤1.2.1Update to 1.2.2	CVE-2012-6718	—	May 15, 2012
Medium6.1	Multiple Cross-Site Scripting LeagueManager≤3.7Update to 3.8	CVE-2012-2912	—	May 15, 2012
High7.1	Cross-Site Scripting WP Forum Server<1.7.5Update to 1.7.5	CVE-2012-6623	—	May 15, 2012
Medium6.1	Authenticated (Admin+) Stored Cross-Site Scripting WP Forum Server≤1.7.3Update to 1.7.4	CVE-2012-6622	—	May 15, 2012
Critical9.8	SQL Injection Sharebar<1.2.2Update to 1.2.2	CVE-2012-6719	—	May 15, 2012
Medium6.1	Cross-Site Scripting Newsletter Manager<1.0.2Update to 1.0.2	CVE-2012-6628	—	May 15, 2012
High7.2	SQL Injection WP Forum Server<1.7.4Update to 1.7.4	CVE-2012-6625	—	May 15, 2012
Medium6.1	Cross-Site Scripting Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)≤2.3Update to 2.3.1	CVE-2012-2913	—	May 15, 2012
Medium6.1	Cross-Site Scripting Sabre<1.2.2Update to 1.2.2	CVE-2012-2916	—	May 15, 2012
Medium6.1	Cross-Site Scripting via test_mail.php Newsletter Manager<1.0.2Update to 1.0.2	CVE-2012-6627	—	May 15, 2012
Medium6.1	Cross-Site Scripting WP-FaceThumb≤0.1Update to 0.2	CVE-2012-2371	—	May 13, 2012
Medium6.1	Cross-Site Scripting 2 Click Social Media Buttons<0.34Update to 0.34	CVE-2012-4273	—	May 11, 2012
Medium6.1	Multiple Cross-Site Scripting 2 Click Social Media Buttons≤0.33Update to 0.34	CVE-2012-4272	—	May 11, 2012
Medium6.1	Reflected Cross-Site Scripting BulletProof Security<.47.1Update to .47.1	CVE-2012-4268	—	May 11, 2012
High7.2	Cross-Site Scripting Kadence Security – Password, Two Factor Authentication, and Brute Force Protection<3.2.5Update to 3.2.5	CVE-2012-4263	—	May 11, 2012
Medium6.1	Multiple Cross-Site Scripting Kadence Security – Password, Two Factor Authentication, and Brute Force Protection≤3.2.4Update to 3.2.5	CVE-2012-4264	—	May 11, 2012
Medium6.1	2.2.4 - Cross-Site Scripting Bad Behavior<2.2.5Update to 2.0.47 or 2.2.5	CVE-2012-4271	—	May 11, 2012
Medium6.1	Cross-Site Scripting User Photo≤0.9.5Update to 0.9.5.2	CVE-2012-2920	—	May 9, 2012
Medium6.1	Cross-Site Scripting AJAX Auth – Fast Logins, 2FA, Redirects<3.0.4.1Update to 3.0.5	CVE-2012-4283	—	May 7, 2012
Medium6.1	Reflected Cross-Site Scripting Redirection<2.2.12Update to 2.2.12	CVE-2012-6717	—	May 4, 2012
Medium6.1	Cross-Site Scripting zingiri-web-shop<2.4.2Update to 2.4.2	CVE-2012-6506	—	Apr 26, 2012
Medium5.3	Sensitive Information Disclosure ShareYourCart<1.7.1Update to 1.7.1	CVE-2012-4332	—	Apr 24, 2012
Medium6.1	Multiple Cross-Site Scripting Organizer≤1.2.1No patch available	CVE-2012-6511	—	Apr 23, 2012
Medium5.4	Cross-Site Scripting WordPress≤3.3.1Update to 3.3.2	CVE-2012-2404	—	Apr 21, 2012
High7.2	Cross-Site Scripting WordPress≤3.5.1Update to 3.5.2	CVE-2012-2399	—	Apr 21, 2012
Medium5.4	Authorization Bypass WordPress≤3.3.1Update to 3.3.2	CVE-2012-2402	—	Apr 20, 2012

Medium6.1
Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.1.7Update to 5.1.7
CVE-2012-6716May 22, 2012
High7.2
Cross-Site Scripting
Share and Follow
≤1.80.3Update to 1.80.4
CVE-2012-2917May 21, 2012
Medium6.1
Cross-Site Scripting
AJAX Auth – Fast Logins, 2FA, Redirects
≤3.0.4Update to 3.0.4.1
CVE-2012-2759May 18, 2012
Medium6.1
Cross-Site Scripting
SoundCloud Is Gold
≤2.2Update to 2.2.1
CVE-2012-6624May 15, 2012
Medium6.1
Cross-Site Scripting
Sharebar
≤1.2.1Update to 1.2.2
CVE-2012-6718May 15, 2012
Medium6.1
Multiple Cross-Site Scripting
LeagueManager
≤3.7Update to 3.8
CVE-2012-2912May 15, 2012
High7.1
Cross-Site Scripting
WP Forum Server
<1.7.5Update to 1.7.5
CVE-2012-6623May 15, 2012
Medium6.1
Authenticated (Admin+) Stored Cross-Site Scripting
WP Forum Server
≤1.7.3Update to 1.7.4
CVE-2012-6622May 15, 2012
Critical9.8
SQL Injection
Sharebar
<1.2.2Update to 1.2.2
CVE-2012-6719May 15, 2012
Medium6.1
Cross-Site Scripting
Newsletter Manager
<1.0.2Update to 1.0.2
CVE-2012-6628May 15, 2012
High7.2
SQL Injection
WP Forum Server
<1.7.4Update to 1.7.4
CVE-2012-6625May 15, 2012
Medium6.1
Cross-Site Scripting
Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)
≤2.3Update to 2.3.1
CVE-2012-2913May 15, 2012
Medium6.1
Cross-Site Scripting
Sabre
<1.2.2Update to 1.2.2
CVE-2012-2916May 15, 2012
Medium6.1
Cross-Site Scripting via test_mail.php
Newsletter Manager
<1.0.2Update to 1.0.2
CVE-2012-6627May 15, 2012
Medium6.1
Cross-Site Scripting
WP-FaceThumb
≤0.1Update to 0.2
CVE-2012-2371May 13, 2012
Medium6.1
Cross-Site Scripting
2 Click Social Media Buttons
<0.34Update to 0.34
CVE-2012-4273May 11, 2012
Medium6.1
Multiple Cross-Site Scripting
2 Click Social Media Buttons
≤0.33Update to 0.34
CVE-2012-4272May 11, 2012
Medium6.1
Reflected Cross-Site Scripting
BulletProof Security
<.47.1Update to .47.1
CVE-2012-4268May 11, 2012
High7.2
Cross-Site Scripting
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
<3.2.5Update to 3.2.5
CVE-2012-4263May 11, 2012
Medium6.1
Multiple Cross-Site Scripting
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
≤3.2.4Update to 3.2.5
CVE-2012-4264May 11, 2012
Medium6.1
2.2.4 - Cross-Site Scripting
Bad Behavior
<2.2.5Update to 2.0.47 or 2.2.5
CVE-2012-4271May 11, 2012
Medium6.1
Cross-Site Scripting
User Photo
≤0.9.5Update to 0.9.5.2
CVE-2012-2920May 9, 2012
Medium6.1
Cross-Site Scripting
AJAX Auth – Fast Logins, 2FA, Redirects
<3.0.4.1Update to 3.0.5
CVE-2012-4283May 7, 2012
Medium6.1
Reflected Cross-Site Scripting
Redirection
<2.2.12Update to 2.2.12
CVE-2012-6717May 4, 2012
Medium6.1
Cross-Site Scripting
zingiri-web-shop
<2.4.2Update to 2.4.2
CVE-2012-6506Apr 26, 2012
Medium5.3
Sensitive Information Disclosure
ShareYourCart
<1.7.1Update to 1.7.1
CVE-2012-4332Apr 24, 2012
Medium6.1
Multiple Cross-Site Scripting
Organizer
≤1.2.1No patch available
CVE-2012-6511Apr 23, 2012
Medium5.4
Cross-Site Scripting
WordPress
≤3.3.1Update to 3.3.2
CVE-2012-2404Apr 21, 2012
High7.2
Cross-Site Scripting
WordPress
≤3.5.1Update to 3.5.2
CVE-2012-2399Apr 21, 2012
Medium5.4
Authorization Bypass
WordPress
≤3.3.1Update to 3.3.2
CVE-2012-2402Apr 20, 2012