CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 29)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
≤2.9.2.6Update to 2.9.2.7
- Medium5.3Missing Authorization
Flexible Quantity & Price Calculator for WooCommerce
≤2.3.24Update to 2.3.25
- Medium5.3Missing Authorization
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.12.9Update to 2.13.0
- Medium5.3Missing Authorization
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.13.5Update to 3.13.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.8.0.2Update to 3.8.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
≤4.17.0Update to 4.18.0
- Medium4.3Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.55Update to 3.7.56
- Medium4.3Missing Authorization
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar
≤6.5.4Update to 6.5.5
- Medium4.3Missing Authorization
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.13Update to 4.3.14
- Medium5.3Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.26Update to 2.10.0
- Medium5.3Missing Authorization
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.13Update to 4.3.14
- Medium6.5Authenticated (Contributor+) SQL Injection
JetEngine
≤3.9.0.1Update to 3.9.0.2
- Medium5.3Missing Authorization
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.27Update to 2.4.28
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetSmartFilters
≤3.8.6.2Update to 3.8.6.3
- Medium4.3Cross-Site Request Forgery
InstaWP Connect – 1-click WP Staging & Migration
≤0.1.4.2Update to 0.1.4.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Import and export users and customers
≤2.5.9Update to 2.5.10
- Medium4.3Missing Authorization
HivePress Claim Listings
≤1.1.4Update to 1.1.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PDF Poster – Let visitors read PDF’s without leaving the page
≤2.6.1Update to 2.6.2
- Medium5.3Missing Authorization
Simple CAPTCHA with Cloudflare Turnstile
≤1.44.0Update to 1.44.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.27Update to 2.4.28
- Medium4.3Missing Authorization
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.7.1Update to 2.7.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Video Gallery Block – showcase your videos in a filterable gallery
≤1.6.0Update to 1.7.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
≤2.2.27Update to 2.2.28
- Medium4.3Missing Authorization
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.27Update to 2.4.28
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Site Reviews
≤8.3.5Update to 8.3.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
≤7.9.7Update to 7.9.8
- Medium4.3Missing Authorization
JetEngine
≤3.9.0.1Update to 3.9.0.2
- Medium5.3Missing Authorization
Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels
≤7.14.1Update to 7.14.2
- Medium5.3Missing Authorization
YITH PayPal Express Checkout for WooCommerce
≤1.62.0Update to 1.62.1