CVE-2026-85573

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...

CVE-2026-85576

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...

CVE-2026-85573 All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...

CVE-2026-85576 All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...

WordPress All in One Files Upload plugin < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update vulnerability

Subscriber+ Arbitrary Plugin Settings Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin All in One Files Upload versions 2.0.17...

CVE-2026-85576 All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...

EUVD-2026-89631

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...

CVE-2026-85573

The All in One Files Upload WordPress plugin (specifically for WooCommerce ), versions 2.0.3 through 2.0.16 , is vulnerable to unauthenticated stored XSS . The root cause is that the plugin adds SVG to allowed upload types but fails to sanitize uploaded files or verify the authenticity of public ...

EUVD-2026-89630

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...

CVE-2026-85573 All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...

CVE-2026-85576

The All in One Files Upload WordPress plugin, specifically versions before 2.0.17 , is vulnerable to an unauthorized settings modification. The root cause is a lack of capability checks and a failure to verify the authenticity of the request when saving plugin settings. This flaw allows any authe...

CVE-2026-96825: Authentication Bypass by Spoofing

Subscriber Bypass Vulnerability in All In One WP Security & Firewall = 5.4.8 versions...

PT-2026-103210

Subscriber Bypass Vulnerability in All In One WP Security & Firewall = 5.4.8 versions...

PT-2026-103030

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...

PT-2026-103031

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...

CVE-2026-85576: Missing Authorization

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...

CVE-2026-85573: Improper Neutralization of Input During Web Page Generation

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...

WordPress All In One WP Security & Firewall plugin <= 5.4.8 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin All In One WP Security & Firewall versions = 5.4.8...

WordPress All-in-One WP Migration and Backup plugin < 7.111 - Authenticated Privilege Escalation to Admin vulnerability

Authenticated Privilege Escalation to Admin vulnerability discovered by Charles Vosburgh in WordPress Plugin All-in-One WP Migration versions 7.111...

CVE-2026-17586

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnitctaimgposition' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...