CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 17)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.
≤3.1.6Update to 3.1.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.3Update to 1.58.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤4.3.5Update to 4.3.6
- Medium6.1Reflected Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤4.3.5Update to 4.3.6
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Redux Framework
≤4.5.16Update to 4.5.17
- High7.2Unauthenticated Stored Cross-Site Scripting
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.12.0Update to 2.12.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction
≤3.8.4.15Update to 3.8.4.16
- Medium5.3Unauthenticated Information Exposure
FloristPress for Woo – Customize your eCommerce store for your Florist
≤7.8.4Update to 7.8.5
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
≤4.3.0Update to 4.3.1
- High7.2Unauthenticated Server-Side Request Forgery
Stape Conversion Tracking
<2.3.11Update to 2.3.11
- High8.1Unauthenticated PHP Object Injection
Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events
≤1.0.20Update to 1.0.21
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
VikWidgetsLoader – Collection of Widgets
<1.12.3Update to 1.12.3
- Medium4.3Missing Authorization
Advanced Custom Fields (ACF®)
≤6.8.10Update to 6.8.11
- Medium6.3Authentication Bypass via SAML Relay
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
≤45.1Update to 45.2
- Medium4.32.0.2 - Authenticated (Custom+) Payment Bypass
wePOS – Point Of Sale (POS) for WooCommerce & Dokan
1.2.6 – 2.0.2Update to 2.0.3
- Medium5.3Unauthenticated Payment Processing Bypass
Payment forms, Buy now buttons, and Invoicing System | GetPaid
≤2.8.62Update to 2.8.63
- Medium4.3Missing Authorization
Payment forms, Buy now buttons, and Invoicing System | GetPaid
≤2.8.62Update to 2.8.63
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Premium Packages – Sell Digital Products Securely
<7.3.1Update to 7.3.1
- High7.20.9.136 - Authenticated (Administrator+) Arbitrary File Upload
WPvivid — Backup, Migration & Staging
0.9.117 – 0.9.136Update to 0.9.137
- Medium4.3Missing Authorization
Simple Download Monitor
<4.1.3Update to 4.1.3
- Medium5.3Unauthenticated Free Confirmed Booking Creation
Booking Package
<1.7.34Update to 1.7.34
- High7.2Unauthenticated Stored Cross-Site Scripting
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
<1.15.51Update to 1.15.51
- Medium4.3Missing Authorization
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
<1.17.11Update to 1.17.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
CookieYes – Cookie Banner, Cookie Consent & Cookie Notice for GDPR/CCPA
<3.5.8Update to 3.5.8
- Medium5.3Missing Authorization
Mollie Payments for WooCommerce
<8.2.0Update to 8.2.0
- Medium4.36.8.10 - Authenticated (Contributor+) Insecure Direct Object Reference
Advanced Custom Fields (ACF®)
6.2.0 – 6.8.10Update to 6.8.11
- Medium4.3Authenticated (Contributor+) Information Exposure
Advanced Custom Fields (ACF®)
≤6.8.10Update to 6.8.11
- Medium5.36.4.0 - [Fill this out]
Pay with Vipps and MobilePay for WooCommerce
5.0.0 – 6.4.0Update to 6.4.1
- Medium5.39.18 - Unauthenticated Unpaid Event Registration Confirmation
Quick Event Manager
9.9.5 – 9.18Update to 9.19
- Medium5.3Unauthenticated Payment Bypass
Order Tracking – WordPress Status Tracking Plugin
≤3.5.0Update to 3.6.0