CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 38)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated SQL Injection
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
≤3.8.5.2Update to 3.8.6
- Medium6.1Reflected Cross-Site Scripting
eCommerce Product Catalog
≤3.6.4Update to 3.6.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Discussion Board – WordPress Forum Plugin
≤2.6.0Update to 2.6.1
- High7.5Unauthenticated SQL Injection
DXP ToolKit
≤2.0.1Update to 2.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting
DXP ToolKit
≤2.0.1Update to 2.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Payment forms, Buy now buttons, and Invoicing System | GetPaid
≤2.8.62Update to 2.8.63
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetSmartFilters
≤3.8.6.1Update to 3.8.6.2
- Medium4.3Missing Authorization
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce
≤4.7.5Update to 4.7.6
- Medium5.3Missing Authorization
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce
≤4.7.5Update to 4.7.6
- Medium5.3Missing Authorization
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.10.7Update to 1.11.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Panorama – Turn Photos into Immersive Virtual Tours
≤1.8.3Update to 1.8.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
bSlider – Build Sliders That Bring Your Content to Life
≤2.2.2Update to 2.2.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
≤2.9.2.5Update to 2.9.2.6
- Medium4.3Authenticated (Contributor+) Information Exposure
Media Library Assistant
≤3.42Update to 3.43
- Medium4.3Missing Authorization
Geo Mashup
≤1.13.22Update to 1.13.23
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Geo Mashup
≤1.13.22Update to 1.13.23
- Medium6.5Authenticated (Contributor+) SQL Injection
JetEngine
≤3.9.0Update to 3.9.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Lazy Load for Videos
≤2.18.11Update to 2.18.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Better Post & Filter Widgets for Elementor
≤1.9.1Update to 1.9.2
- Medium6.5Authenticated (Author+) SQL Injection
Media Library Assistant
≤3.42Update to 3.43
- Medium4.3Missing Authorization
Better Post & Filter Widgets for Elementor
≤1.9.1Update to 1.9.2
- Medium6.1Reflected Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- Medium5.3Missing Authorization
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
≤2.8.2Update to 2.8.3
- Medium5.3Unauthenticated Insecure Direct Object Reference
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1069Update to 1.7.1070
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1069Update to 1.7.1070
- Medium4.3Cross-Site Request Forgery
Media Library Assistant
≤3.42Update to 3.43
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1069Update to 1.7.1070
- Medium5.3Missing Authorization
Bopo – WooCommerce Product Bundle Builder
≤1.2.3Update to 1.2.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.8.0.1Update to 3.8.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Image Gallery Block – Showcase Photos in Stunning Responsive Grids
≤2.4.1Update to 2.4.2