CVE-2025-11889

CVE-2025-11889 : WordPress plugin AIO Forms – Craft Complex Forms Easily is vulnerable to authenticated arbitrary file upload via the Zip Import feature due to missing file type validation in versions up to and including 1.3.15 . The flaw allows users with Administrator-level access and above to ...

CVE-2025-11889 AIO Forms <= 1.3.15 - Authenticated (Admin+) Arbitrary File Upload via Zip Import

The AIO Forms – Craft Complex Forms Easily plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 1.3.15. This makes it possible for authenticated attackers, with Administrator-level access...

CVE-2025-6440

The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'wcdpsavecanvasdesignajax' function in all versions up to, and including, 1.9.26. This mak...

CVE-2025-6440 WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload

The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'wcdpsavecanvasdesignajax' function in all versions up to, and including, 1.9.26. This mak...

CVE-2025-6440

Concrete details found for CVE-2025-6440: The WooCommerce Designer Pro plugin for WordPress (used by the Pricom theme) contains a critical Arbitrary File Upload flaw in the wcdp_save_canvas_design_ajax function, present in all versions up to and including 1.9.26. An unauthenticated attacker can u...

CVE-2025-6440 WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload

The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'wcdpsavecanvasdesignajax' function in all versions up to, and including, 1.9.26. This mak...

PT-2025-43595

Name of the Vulnerable Software and Affected Versions AIO Forms – Craft Complex Forms Easily plugin for WordPress versions through 1.3.15 Description The AIO Forms – Craft Complex Forms Easily plugin for WordPress is susceptible to arbitrary file uploads because of a lack of file type validation...

PT-2025-43584

Name of the Vulnerable Software and Affected Versions WooCommerce Designer Pro versions up to and including 1.9.26 Description The WooCommerce Designer Pro plugin for WordPress is affected by a critical issue allowing arbitrary file uploads. This is due to missing file type validation within the...

WordPress AIO Forms plugin <= 1.3.18 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by tmrswrr in WordPress Plugin AIO Forms versions = 1.3.18...

Exploit for CVE-2025-48148

CVE-2025-48148 StoreKeeper for WooCommerce = 14.4.4 - Unau...

CVE-2025-58963 WordPress Medcity theme < 1.1.9 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in 7oroof Medcity medcity allows Upload a Web Shell to a Web Server.This issue affects Medcity: from n/a through 1.1.9...

CVE-2025-58963

CVE-2025-58963 affects WordPress Medcity theme (versions prior to 1.1.9). The Red Hat and NVD entries, EUVD/ENISA records, and CVE listings consistently describe an unrestricted upload of files with dangerous types in the Medcity plugin/theme, enabling upload of a Web Shell to the web server. Roo...

CVE-2025-58963 WordPress Medcity theme < 1.1.9 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in 7oroof Medcity medcity allows Upload a Web Shell to a Web Server.This issue affects Medcity: from n/a through 1.1.9...

CVE-2025-52758 WordPress Zippy plugin <= 1.7.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Gesundheit Bewegt GmbH Zippy zippy allows Using Malicious Files.This issue affects Zippy: from n/a through = 1.7.0...

CVE-2025-52758

CVE-2025-52758 concerns the WordPress Zippy plugin (versions through 1.7.0) with an unrestricted file upload flaw. The vulnerability stems from allowing dangerous file types to be uploaded, enabling the use of malicious files. Documented impact indicates potential compromise via uploaded content,...

CVE-2025-52758 WordPress Zippy plugin <= 1.7.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Gesundheit Bewegt GmbH Zippy zippy allows Using Malicious Files.This issue affects Zippy: from n/a through = 1.7.0...

CVE-2025-49060 WordPress Wastia theme < 1.1.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Wastia wastia allows Upload a Web Shell to a Web Server.This issue affects Wastia: from n/a through 1.1.3...

CVE-2025-49060

CVE-2025-49060 affects CMSSuperHeroes Wastia (WordPress plugin/theme) with unrestricted upload of dangerous file types, enabling potential web shell uploads. Affected: Wastia versions prior to 1.1.3. Root cause: flaw in handling uploaded file types leading to arbitrary file upload. Impact per sou...

CVE-2025-49060 WordPress Wastia theme < 1.1.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Wastia wastia allows Upload a Web Shell to a Web Server.This issue affects Wastia: from n/a through 1.1.3...

CVE-2025-48106 WordPress Clanora theme < 1.3.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Clanora clanora allows Using Malicious Files.This issue affects Clanora: from n/a through 1.3.1...