CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 35)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.9Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp_file' Parameter via Mass Assignment
Tainacan
≤1.3.0Update to 1.4.0
- High7.2Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.7.8Update to 5.7.9
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_rating
MxChat – AI Chatbot & Content Generation for WordPress
≤3.2.25Update to 3.2.26
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute
Mang Board
≤2.4.5Update to 2.4.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'conversion' Shortcode Attribute
If-So Dynamic Content – Elementor & All Page Builders Personalization
≤1.10.2Update to 1.10.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' Parameter
If-So Dynamic Content – Elementor & All Page Builders Personalization
≤1.10.2Update to 1.10.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attribute
easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution
≤2.8.2Update to 2.8.3
- Medium4.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute
DesignSetGo
≤2.11.0Update to 2.11.1
- Medium6.4Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute
Document Embedder – let visitors read files without downloading
≤2.4.0Update to 2.4.1
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook
Clean Login
≤1.20.1Update to 1.21
- Medium4.8Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter
Customer Email Verification for WooCommerce – OTP Verification, Block Fake Signups
≤2.8.2Update to 2.8.3
- High7.5Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload
Product Designer for WooCommerce WordPress | Lumise
≤2.1.2No patch available
- Medium4.3Cross-Site Request Forgery
Newsletters
≤4.18.2No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter
Appointment Booking Calendar
≤1.4.05Update to 1.4.06
- High7.5Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
≤3.9.2Update to 3.9.3
- High7.5Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute
Animated Text Block – Add Typing and Looping Text Effects
≤1.2.6Update to 1.2.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤4.9.7Update to 5.0.0
- Medium4.2Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.8.4Update to 3.8.5
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter
AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot
≤1.2.8Update to 1.2.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤4.9.7Update to 5.0.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute
AMP for WP – Accelerated Mobile Pages
≤1.1.17Update to 1.1.18
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Attachment Modification via 'post_id' Parameter
AI Alt Text Generator
≤2.7.0Update to 2.7.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
≤3.9.2Update to 3.9.3
- Critical9.8Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler
Pie Register Premium
≤3.8.4.0Update to 3.8.4.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.14.0Update to 2.14.1
- Critical9.8Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter
Jupiter X Core
≤4.61.0Update to 4.62.0
- Medium6.1Reflected Cross-Site Scripting
TableOn – WordPress Posts Table Filterable
≤1.0.7Update to 1.0.8
- High7.5Unauthenticated SQL Injection
Motors – Car Dealership & Classified Listings Plugin
≤1.4.126Update to 1.4.127
- Medium6.1Reflected Cross-Site Scripting
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.
≤3.1.7No patch available
- Medium6.1Reflected Cross-Site Scripting
OceanWP
≤4.2.7Update to 4.2.8