CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 79)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Jetpack – AI Agents & MCP, Security, Backup & Analytics
≤16.2Update to 16.3
- Medium5.3Missing Authorization
WP Rocket
<3.23.5Update to 3.23.5
- High7.5Authenticated (Subscriber+) PHP Object Injection
Neo | Barber Shop WordPress Theme
≤3.5No patch available
- Medium6.1Reflected Cross-Site Scripting
Education Center | LMS & Online Courses WordPress Theme
≤3.6.12No patch available
- Medium6.1Reflected Cross-Site Scripting
Voldor - Welding & Metal Work WordPress Theme
≤1.0.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Treck - Immigration and Visa Consulting WordPress Theme
≤1.0.0No patch available
- Critical9.8Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
Bricksforge
≤3.1.8.9Update to 3.1.8.10
- Medium5.37.1.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds
WordPress
≤7.1.2Update to 4.7.38 or 4.8.33 or 4.9.34 or 5.0.30 or 5.1.27 or 5.2.29 or 5.3.26 or 5.4.24 or 5.5.23 or 5.6.22 or 5.7.20 or 5.8.18 or 5.9.19 or 6.0.17 or 6.1.15 or 6.2.14 or 6.3.13 or 6.4.13 or 6.5.13 or 6.6.10 or 6.7.10 or 6.8.11 or 6.9.10 or 7.0.7 or 7.1.3
- Medium6.5Authenticated (Subscriber+) SQL Injection
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale)
≤1.13.1Update to 1.13.6
- High8.1Kute Fashion WooCommerce Theme ( RTL Supported ) <= 2.3.3 - Unauthenticated Local File Inclusion
Boutique - Kute Fashion WooCommerce Theme ( RTL Supported )
≤2.3.3No patch available
- Medium6.5Kute Fashion WooCommerce Theme ( RTL Supported ) <= 2.3.3 - Unauthenticated Arbitrary Shortcode Execution
Boutique - Kute Fashion WooCommerce Theme ( RTL Supported )
≤2.3.3No patch available
- High8.1Electronics Multipurpose WooCommerce Theme ( RTL Supported ) <= 3.0.3 - Unauthenticated Local File Inclusion
TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported )
≤3.0.3No patch available
- Medium6.1Electronics Multipurpose WooCommerce Theme ( RTL Supported ) <= 3.0.3 - Reflected Cross-Site Scripting
TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported )
≤3.0.3No patch available
- High8.1Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) <= 1.4.8 - Unauthenticated Local File Inclusion
Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported)
≤1.4.8No patch available
- Medium6.1Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) <= 1.4.8 - Reflected Cross-Site Scripting
Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported)
≤1.4.8No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤9.2Update to 9.3
- High8.1Unauthenticated Local File Inclusion
CleanSkin | Handmade Organic Soap & Natural Cosmetics Shop WordPress Theme + Elementor
≤1.5.0No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
ACF Frontend Admin by DynamiApps
≤3.29.13Update to 3.30.0
- High8.1Unauthenticated PHP Object Injection
payever Checkout – Composable Payment Gateway
≤4.8.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Slider by 10Web – Responsive Image Slider
≤1.2.63No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Food Menu – Restaurant Menu & Online Ordering for WooCommerce
≤6.0.5Update to 6.0.6
- Medium5.3Missing Authorization
grandnews
≤3.4No patch available
- Medium5.3Missing Authorization
Jetpack – AI Agents & MCP, Security, Backup & Analytics
≤16.2Update to 16.3
- Medium4.9Authenticated (Administrator+) SQL Injection
Code Snippets
≤3.9.0Update to 3.10.0
- Medium4.3Authenticated (Subscriber+) Information Exposure
QA Assistants – Driven by data
≤5.3.0.0Update to 5.3.0.1
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
MKL Product Configurator for WooCommerce – 2D & 3D Live Preview
≤1.7.5Update to 1.7.6
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Associate Post R2
≤5.0.1Update to 5.0.2
- High7.5Authenticated (Contributor+) PHP Object Injection
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.7Update to 11.2.8
- Medium5.3Payment Verification Bypass to Unauthenticated Arbitrary Order Payment Forgery
Super Payments – WooCommerce Payment Gateway
≤1.43.0Update to 1.43.1
- High7.2Authenticated (Administrator+) Arbitrary File Upload
AWP Classifieds
≤4.4.8Update to 4.4.9