CWE-434Vulnerability type
WordPress Arbitrary File Upload vulnerabilities (page 8)
Upload handlers that accept PHP files, the shortest route from a plugin bug to a webshell.
- Medium5.3Missing Authorization
Ultimate Store Kit – Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder
≤4.0.1Update to 4.0.2
- Medium5.3Missing Authorization
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
≤3.3.0Update to 3.3.1
- Medium4.3Missing Authorization
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.12.0Update to 2.12.1
- Medium4.3Missing Authorization
Media Library Assistant
≤3.43Update to 3.44
- Medium4.3Cross-Site Request Forgery
Photo Gallery by Supsystic – Image Gallery, Masonry, Albums & Lightbox
≤1.21.6Update to 1.21.7
- Medium5.3Missing Authorization
MoreConvert Wishlist for WooCommerce
≤2.0.3Update to 2.0.4
- Medium4.3Missing Authorization
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤4.3.3Update to 4.3.4
- Medium5.3Missing Authorization
Premium Blocks – Gutenberg Blocks, Patterns & Templates
≤2.3.18Update to 2.3.19
- Medium4.3Missing Authorization
Dynific Addons for Elementor (formerly Anywhere Elementor)
≤1.3.0Update to 1.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MoreConvert Wishlist for WooCommerce
≤2.0.3Update to 2.0.4
- Medium5.3Missing Authorization
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution
≤2.5.0Update to 2.6.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Recipe Maker
≤10.9.1Update to 10.9.2
- Medium4.3Missing Authorization
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.8.3Update to 3.8.4
- Medium6.4Authenticated (Vendor+) Stored Cross-Site Scripting
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.8.3Update to 3.8.4
- Medium4.3Missing Authorization
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤4.0.2Update to 4.0.3
- Medium4.3Cross-Site Request Forgery
Wp Social Login and Register Social Counter
≤3.2.3Update to 3.2.4
- Medium4.3Missing Authorization
VOD Infomaniak
≤1.5.15Update to 1.5.16
- Medium5.3Missing Authorization
WP-Lister Lite for Amazon
≤2.9.2Update to 2.9.2.5
- Medium5.3Unauthenticated Information Exposure
YITH WooCommerce Subscription
≤4.22.0Update to 4.23.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'data[ip]' Parameter
Subscribe2 – Form, Email Subscribers & Newsletters
≤10.47Update to 10.48
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameter
Flipbox – Awesomes Flip Boxes Image Overlay
≤3.1.1Update to 3.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'help_title' Shortcode Attribute
Active Woot Products Tables for WooCommerce. 100% FREE
≤2.1.5Update to 2.1.6
- Medium4.3Missing Authorization
Meta Box – A Framework for Dynamic Websites
≤5.15.3Update to 5.15.4
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
≤3.3.0Update to 3.3.1
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Exeuction
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.56Update to 3.7.57
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.26Update to 2.0.28
- Medium4.3Authenticated (Subscriber+) Brute-Force Lockout Bypass
WPBruiser Security – No CAPTCHA Anti-Spam & Login Protection
≤3.6.2Update to 3.6.3
- Medium4.3Cross-Site Request Forgery
Superb Addons: Blocks, Patterns, Pre-built Pages, Sliders, Popups, Free Forms, Animations & More
≤4.2.4Update to 4.2.5
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Media Library Assistant
≤3.43Update to 3.44
- Medium6.1Reflected Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.14Update to 7.3.15