CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 41)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.7.0Update to 1.8.0
- Medium4.39.0.2 - Authenticated (Contributor+) Insecure Direct Object Reference
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress
9.0.0 – 9.0.2Update to 9.0.3
- Low2.7Missing Authorization
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<4.0.5Update to 4.0.5
- Medium6.4Authenticated (Give Worker+) Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
≤4.19.0.0Update to 4.19.0.1
- Medium6.5Authenticated (Give Manager+) Path Traversal
GiveWP – Donation Plugin and Fundraising Platform
≤4.19.0.0Update to 4.19.0.1
- Medium5.3Unauthenticated Information Exposure
GiveWP – Donation Plugin and Fundraising Platform
≤4.19.0.0Update to 4.19.0.1
- Low2.7Missing Authorization
Speed Optimizer – The All-In-One Performance-Boosting Plugin
<7.8.5Update to 7.8.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Speed Optimizer – The All-In-One Performance-Boosting Plugin
<7.8.5Update to 7.8.5
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Essential Addons for Elementor – Popular Elementor Templates & Widgets
<6.8.7Update to 6.8.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
<3.2.8Update to 3.2.8
- Medium5.3Missing Authorization
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
<3.2.8Update to 3.2.8
- Medium5.33.2.7 - Missing Authorization
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
3.1.1 – 3.2.7Update to 3.2.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
<3.2.8Update to 3.2.8
- Medium5.3Unauthenticated Payment Bypass
Online Payments with iK Pay Gateway
≤3.0.3Update to 3.0.4
- Medium5.3Unauthenticated Order Payment Forgery
Eurobank WooCommerce Payment Gateway
<2.1.2Update to 2.1.2
- Critical9.8Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace
Prime Mover – Backup and Migration
≤2.2.1Update to 2.2.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter
Anti-Spam, Spam FireWall by CleanTalk
≤6.89.1Update to 6.90
- Medium5.3Missing Authorization
UPI QR Code Payment Gateway for WooCommerce
≤1.6.3Update to 1.7.0
- Medium6.6Authenticated (Editor+) PHP Object Injection
Relevanssi – A Better Search
≤4.28.4Update to 4.28.5
- Medium5.3Missing Authorization
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.7.8Update to 5.7.9
- Medium5.3Missing Authorization
Social Feed Gallery
≤5.0.13No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Extensions for Leaflet Map
≤6.0Update to 6.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ND Shortcodes
≤7.8No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Waitlist Woocommerce ( Back in stock notifier )
≤2.9.1Update to 2.9.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Restaurant Menu – Food Ordering System – Table Reservation
≤2.4.4No patch available
- Medium5.3Missing Authorization
ЮKassa для WooCommerce
≤2.17.3Update to 2.17.4
- Medium5.3Unauthenticated Information Exposure
ShopMagic – email automation for WordPress
≤4.9.1Update to 4.9.2
- Medium6.1Reflected Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- Medium5.3Missing Authorization
Page and Post Restriction
≤1.6.0Update to 1.6.1
- Medium5.3Missing Authorization
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
≤1.2.1Update to 1.2.2