CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 74)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.3Update to 1.58.0
- Medium6.1Reflected Cross-Site Scripting
WPAdverts – Classifieds Plugin
≤2.3.4Update to 2.3.5
- High7.2Unauthenticated Stored Cross-Site Scripting
WPAdverts – Classifieds Plugin
≤2.3.4Update to 2.3.5
- High8.1Unauthenticated PHP Object Injection
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤8.4.0Update to 8.5.0
- High7.5Authenticated (Custom Role+) PHP Object Injection
Tainacan
≤1.3.0Update to 1.4.0
- High7.5Authenticated (Contributor+) PHP Object Injection
Slider by 10Web – Responsive Image Slider
≤1.2.62Update to 1.2.63
- High7.2Unauthenticated Stored Cross-Site Scripting
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.3Update to 1.58.0
- Medium5.3Missing Authorization
Sell Downloads
≤1.2.3Update to 1.2.4
- High8.1Blog Magazine Theme <= 2.2.1 - Unauthenticated PHP Object Injection
Kicker - Blog Magazine Theme
≤2.2.1No patch available
- High8.1Unauthenticated PHP Object Injection
jacqueline
≤2.22No patch available
- High8.1Unauthenticated PHP Object Injection
Alliance | Intranet & Extranet BuddyPress WordPress Theme
≤3.11No patch available
- High8.1Blog \ Resume \ Portfolio \ WordPress Theme <= 3.0.14 - Unauthenticated PHP Object Injection
ShiftCV - Blog \ Resume \ Portfolio \ WordPress Theme
≤3.0.14No patch available
- High8.1Apartment Complex Single Property WordPress Theme <= 2.10 - Unauthenticated PHP Object Injection
Windsor - Apartment Complex Single Property WordPress Theme
≤2.10No patch available
- High8.1Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT <= 3.6.1 - Unauthenticated PHP Object Injection
Qwery - Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT
≤3.6.1No patch available
- High8.1Intranet, Extranet, Community and BuddyPress WordPress Theme <= 1.5.3 - Unauthenticated PHP Object Injection
Anesta - Intranet, Extranet, Community and BuddyPress WordPress Theme
≤1.5.3No patch available
- High8.1Publishing House, Bookshop & BookStore WordPress Theme + RTL <= 2.13.0 - Unauthenticated PHP Object Injection
Booklovers - Publishing House, Bookshop & BookStore WordPress Theme + RTL
≤2.13.0No patch available
- High8.1Unauthenticated PHP Object Injection
Drone Media | Aerial Photography & Videography Theme
≤2.2.0No patch available
- High8.1Unauthenticated PHP Object Injection
Gutentype | 100% Gutenberg Blog Theme + Elementor
≤2.1.12No patch available
- High8.1Unauthenticated PHP Object Injection
Camelia | Floral Studio Florist WordPress Theme
≤1.2.15No patch available
- High8.1Architecture & Interior Design WordPress Theme <= 1.16.0 - Unauthenticated PHP Object Injection
Convex - Architecture & Interior Design WordPress Theme
≤1.16.0No patch available
- High8.1Building, Construction & Renovation Theme <= 1.16.0 - Unauthenticated PHP Object Injection
Dwell - Building, Construction & Renovation Theme
≤1.16.0No patch available
- High8.1Unauthenticated PHP Object Injection
Edema | Wellness & Spa WordPress Theme
≤1.2.2.2No patch available
- High8.1Electric Car Dealership WordPress Theme <= 2.10.0 - Unauthenticated PHP Object Injection
Greeny - Electric Car Dealership WordPress Theme
≤2.10.0No patch available
- High8.1Unauthenticated PHP Object Injection
Hogwords | School, University Education WordPress Theme
≤1.2.7No patch available
- High8.1Cleaning Services WordPress Theme <= 1.21.0 - Unauthenticated PHP Object Injection
Hygia - Cleaning Services WordPress Theme
≤1.21.0No patch available
- High8.1Online Pharmacy Woocommerce Elementor Template Kit <= 1.2.4 - Unauthenticated PHP Object Injection
iPharm - Online Pharmacy Woocommerce Elementor Template Kit
≤1.2.4No patch available
- High8.1Unauthenticated PHP Object Injection
Let's Play | Hockey School & Winter Sports WordPress Theme
≤1.1.15No patch available
- High8.1Unauthenticated PHP Object Injection
Partiso | Political Party & Candidate Elementor Template Kit
≤1.1.13No patch available
- High8.1Unauthenticated PHP Object Injection
Rosalinda | Health Coach & Vegetarian Lifestyle WordPress Theme
≤1.2.4No patch available
- High8.1Unauthenticated PHP Object Injection
Smart Casa | Home Automation & House Technologies WordPress Theme
≤1.0.12No patch available