CWE-98Vulnerability type
WordPress Local File Inclusion vulnerabilities (page 1332)
Template or module loaders that include attacker-chosen files, often leading to code execution.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Directory Traversal
download-zip-attachments
≤1.0No patch available
- High8.8Arbitrary Options Update
Pont - Multipurpose Wordpress Theme | Business
≤1.5No patch available
- Critical9.8Unauthenticated SQL Injection
Email Newsletter
≤20.15No patch available
- Medium6.1Reflected Cross-Site Scripting
NewStatPress
≤1.0.6Update to 1.0.7
- Medium6.1Reflected Cross-Site Scripting
Nextend Twitter Connect
≤1.5.1Update to 1.5.2
- Medium6.1Reflected Cross-Site Scripting
Nextend Social Login and Register
<1.5.6Update to 1.5.6
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
WP Accurate Form Data
≤1.2No patch available
- High8.8Cross-Site Request Forgery
Analyticator
<6.4.9.4Update to 6.4.9.4
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Erident Custom Login Page & Dashboard
≤3.4.1Update to 3.5
- Medium4.3Cross-Site Request Forgery
WP-Stats
<2.52Update to 2.52
- Medium6.1Cross-Site Scripting
WordPress Landing Pages
≤1.8.7Update to 1.8.8
- Medium6.1Cross-Site Scripting
Altos Connect
≤1.3.0No patch available
- High8.6Directory Traversal
Zip Attachments
≤1.5Update to 1.5.1
- High7.5Path Traversal
WordPress Renaming Tool by Vlajo
≤1.0No patch available
- Critical9.8Unauthenticated Local File Inclusion
robotcpa
≤5No patch available
- Medium5.3Path Traversal to Arbitrary File Read
PayPal Currency Converter BASIC for WooCommerce
≤1.3Update to 1.4
- Critical9.8Arbitrary File Upload
Aviary Image Editor Add-on For Gravity Forms
≤3.0 (Beta r7)No patch available
- Critical9.8SQL Injection
NewStatPress
≤1.0.0Update to 1.0.1
- Critical9.8SQL Injection
Easy2Map
<1.2.5Update to 1.2.5
- Medium6.1Cross-Site Scripting
Encrypted Contact Form
<1.1Update to 1.1
- Medium5.3Path Traversal
Easy2Map Photos
≤1.0.9Update to 1.1.0
- Critical9.8SQL Injection
Easy2Map Photos
≤1.0.9Update to 1.1.0
- Medium6.5Directory Traversal
Easy2Map
<1.2.5Update to 1.2.5
- Critical9.8Directory Traversal
SE HTML5 Album Audio Player
≤1.1.0No patch available
- Critical9.8Local File Inclusion
ZM Ajax Login & Register
<1.1.0Update to 1.1.0
- Medium6.1Cross-Site Scripting
ZM Ajax Login & Register
≤1.0.9Update to 1.1.0
- Critical9.8Multiple SQL Injection
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
≤1.5.15Update to 1.5.16
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.5.7.1Update to 5.5.7.1
- High8.8Cross-Site Request Forgery to Remote Code Execution
Codestyling Localization
≤1.99.30No patch available
- Medium6.1Reflected Cross-Site Scripting
Simple Share Buttons Adder
<6.0.1Update to 6.0.1