CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 78)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Image Photo Gallery Final Tiles Grid
<3.6.14Update to 3.6.14
- High7.33.0.4 - Unauthenticated Privilege Escalation
Frontend Dashboard
3.0.0 – 3.0.4Update to 3.0.5
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Thanko Thank You Page Customizer for WooCommerce
≤1.2.3Update to 1.2.4
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute
Super Forms – Drag & Drop Form Builder
≤6.3.316Update to 6.3.317
- Critical9.1Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter
Super Forms – Drag & Drop Form Builder
≤6.3.316Update to 6.3.317
- High8.1Multipurpose eCommerce Template <= 1.3.0 - Unauthenticated Local File Inclusion
Duka Market - Multipurpose eCommerce Template
≤1.3.0No patch available
- High8.1Multipurpose WooCommerce Theme <= 1.0.9 - Unauthenticated Local File Inclusion
Uminex - Multipurpose WooCommerce Theme
≤1.0.9No patch available
- Medium5.3Missing Authorization
DK
≤3.2.1No patch available
- Medium6.1Children Kindergarten and Playgroup WordPress Theme <= 2.2.14.2 - Reflected Cross-Site Scripting
Kids Planet - Children Kindergarten and Playgroup WordPress Theme
≤2.2.14.2No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
≤4.0.0Update to 4.0.1
- Medium6.5Authenticated (Author+) SQL Injection
Slider by 10Web – Responsive Image Slider
≤1.2.63No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion
Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT
≤7.6.1.1Update to 7.7.0
- Medium5.4Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.6.9Update to 5.6.10
- Medium6.1Unauthenticated Stored Cross-Site Scripting via 'url' Parameter
Aurora Heatmap
≤1.7.2Update to 1.7.3
- Medium4.9Authenticated (Administrator+) SQL Injection
Post title marquee scroll
≤9.9No patch available
- Medium4.9Authenticated (Shop Manager+) SQL Injection
Pix por Piggly (para Woocommerce)
≤2.1.2No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
Dynamic User Directory
≤2.4No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
≤3.9.1Update to 3.9.2
- Medium5.3Booking Accommodation WordPress Theme <= 3.14.2 - Missing Authorization
WP Rentals - Booking Accommodation WordPress Theme
≤3.14.2No patch available
- Medium4.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.27Update to 1.0.28
- Medium5.3Unauthenticated Information Exposure
Modula Image Gallery – Photo Grid & Video Gallery
≤3.0.11Update to 3.0.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates
≤3.50.0Update to 3.50.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons
≤4.6.2Update to 4.7.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.7Update to 11.2.8
- Medium4.3Missing Authorization
Hustle – Email Marketing, Lead Generation, Optins, Popups
≤7.8.14.2Update to 7.8.14.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
LazyLoad Plugin – Lazy Load Images, Videos, and Iframes
≤2.4.0Update to 2.4.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤8.8.6Update to 8.8.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Media Library Assistant
≤3.41Update to 3.42
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤8.8.6Update to 8.8.7
- High8.1Unauthenticated Local File Inclusion
kuteshop
≤4.2.9No patch available