CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 4)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
- Medium4.3Missing Authorization
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
≤7.9.9Update to 7.9.10
- Medium5.3Missing Authorization
Restrict User Access – Ultimate Membership & Content Protection
≤2.8.3Update to 2.8.4
- Medium4.3Cross-Site Request Forgery
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
<6.0.8Update to 6.0.8
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Photo Engine (Media Organizer & Lightroom)
<6.6.2Update to 6.6.2
- Medium4.3Missing Authorization
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates
≤3.51.0Update to 3.51.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
YITH WooCommerce Ajax Search
≤2.30.0Update to 2.30.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Passster – Password Protect Pages and Content
≤4.3.21Update to 4.3.22
- Medium4.3Missing Authorization
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.7.2Update to 2.8.0
- Medium5.3Missing Authorization
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<4.17.6Update to 4.17.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Dynific Addons for Elementor (formerly Anywhere Elementor)
<1.3.1Update to 1.3.1
- Medium5.3Missing Authorization
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
<3.3.7Update to 3.3.7
- Medium4.3Cross-Site Request Forgery
Spasalon
≤3.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.12.1Update to 4.13.0
- Medium5.3Unauthenticated Information Exposure
Hubbub Lite – Fast, free social sharing and follow buttons
≤1.36.3.1Update to 1.36.3.2
- Medium5.3Missing Authorization
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<4.17.6Update to 4.17.6
- Medium5.5Authenticated (Administrator+) Server-Side Request Forgery
Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security
<3.4.2Update to 3.4.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
<4.3.6Update to 4.3.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder
≤5.9.11Update to 5.9.12
- Medium4.3Missing Authorization
WP Extended – Modular WordPress Toolkit
≤3.4.2Update to 3.4.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
bBlocks – Essential Gutenberg Blocks & Patterns Collection
≤2.1.15Update to 2.1.16
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
Author Image
≤4.9.3No patch available
- High8.8Authenticated (Subscriber+) Privilege Escalation to Missing Capability and Nonce Check in process_reset()
Reset Database
≤1.1.3No patch available
- High8.8Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'six_storage_online_api_url' Option Poisoning + Transient-Backed Auth Bypass
6Storage Rentals
≤2.31.0No patch available
- Medium6.1Reflected Cross-Site Scripting via '{HREF}' Dynamic Variable
Joinchat – Enhanced “click to chat”
≤6.3.1Update to 6.3.2
- High8.1Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header
ARforms
≤7.2.4Update to 7.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Referer Header
ARforms
≤7.2.4Update to 7.3
- High7.2Unauthenticated Stored Cross-Site Scripting via 'description' Parameter
ARforms
≤7.2.4Update to 7.3
- Medium6.1Reflected Cross-Site Scripting via 'text_no_products' Parameter
Product Filter for WooCommerce by WBW
≤3.4.5Update to 3.4.6
- Critical9.8Unauthenticated Authentication Bypass via Forged Opauth Callback Signature with Hardcoded Fallback Salt
Basel Post Types
≤1.18Update to 1.19
- High7.5Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_files
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.6.3No patch available