CWE-98Vulnerability type
WordPress Local File Inclusion vulnerabilities (page 1325)
Template or module loaders that include attacker-chosen files, often leading to code execution.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Cross-Site Scripting via p_name parameter
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.63Update to 1.5.63
- High8.8Authenticated Blind SQL Injection
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.64Update to 1.5.64
- Critical9.8SQL Injection
Google Doc Embedder
<2.5.17Update to 2.5.17
- Medium6.1Reflected Cross-Site Scripting
Auto Thickbox Plus
≤1.9No patch available
- Medium6.1Reflected Cross-Site Scripting
Websimon Tables
≤1.3.4No patch available
- High7.2Authenticated SQL Injection
WP-Stats-Dashboard
≤2.9.4No patch available
- Critical9.8SQL Injection
Double Opt-In for Download
<2.0.9Update to 2.0.9
- High7.2Authenticated (Admin+) SQL Injection
Watu Quiz
≤2.6.7Update to 2.6.8
- High8.8Arbitrary File Upload
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.59Update to 1.5.59
- Medium6.1Reflected Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<2.2.5Update to 2.2.5
- Critical9.8SQL Injection
WP Fastest Cache – WordPress Cache Plugin
<0.8.4.9Update to 0.8.4.9
- Medium6.1Cross-Site Scripting
Tag Miner (Automatic Tag Extraction)
<1.1.5Update to 1.1.5
- High8.8Cross-Site Request Forgery
Tag Miner (Automatic Tag Extraction)
<1.1.5Update to 1.1.5
- Medium6.1Reflected Cross-Site Scripting
neuvoo-jobroll
≤2.0No patch available
- Medium6.1Reflected Cross-Site Scripting
neuvoo-jobroll
≤2.0No patch available
- Critical9.0Remote File Inclusion
Gwolle Guestbook
<1.5.4Update to 1.5.4
- Medium6.1Cross-Site Scripting
WordPress Calls to Action
<2.5.1Update to 2.5.1
- Critical9.8Arbitrary File Upload
Iptanus File Upload
<3.4.1Update to 3.4.1
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Crony Cronjob Manager
<0.4.7Update to 0.4.7
- Critical9.8SQL Injection
Visitors Online by BestWebSoft
≤0.3Update to 0.4
- High8.8SQL Injection
wp-championship
<5.9Update to 5.9
- High8.8Authenticated SQL Injection
Dynamic Widgets
≤1.5.10Update to 1.5.11
- Medium6.1Cross-Site Scripting
Akismet Anti-spam: Spam Protection
<3.1.5Update to 3.1.5
- Medium6.1Cross-Site Scripting
Connect Matomo – Analytics Dashboard for WordPress
<1.0.5Update to 1.0.5
- Medium4.9Path Traversal
Font – official webfonts plugin of Fonts For Web. NO CODING! Just click & change font size, color and font face visually!
≤7.5Update to 7.5.1
- Medium6.3Authenticated SQL Injection
Pie Register – User Registration, Profiles & Content Restriction
<2.0.19Update to 2.0.19
- Medium6.1Reflected Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction
<2.0.19Update to 2.0.19
- High8.8Arbitrary File Upload
Ajax Load More – Infinite Scroll, Load More, & Lazy Load
≤2.8.1.1Update to 2.8.1.2
- Critical9.8SQL Injection
Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms
<1.1.1Update to 1.1.1
- High7.5Arbitrary File Download
History Collection
≤1.1.1No patch available