CubeWP – All-in-One Dynamic Content Framework < 1.1.13 - Authenticated (Subscriber+) Arbitrary File Upload

Description The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the cwpimportdatacallback function in all versions up to, and including, 1.1.12. This makes it possible for authenticated attackers, wi...

WordPress EnvíaloSimple plugin <= 2.3 - Cross-Site Request Forgery to Arbitrary File Upload vulnerability

Cross-Site Request Forgery to Arbitrary File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin EnvíaloSimple versions = 2.3...

WordPress EnvíaloSimple Plugin <= 2.3 is vulnerable to Arbitrary File Upload

Software EnvíaloSimple Type Plugin Vulnerable versions = 2.3 Fixed in 2.4 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-2125 Patch priority High CVSS severity High 9.6 Developer Claim ownership PSID 3f5859f4f7d7 Credits Francesco Carlucci Required privilege...

Wordpress Plugin - Membership For WooCommerce < v2.1.7 - Arbitrary File Upload to Shell (Unauthenticated)

Exploit Title: Wordpress Plugin - Membership For WooCommerce Resultz Uploader Uploaded ?PHP...

CVE-2024-30533 WordPress Layouts for Elementor plugin < 1.8 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Techeshta Layouts for Elementor.This issue affects Layouts for Elementor: from n/a before 1.8...

CVE-2024-31114 WordPress Shortcode Addons <= 3.2.5 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in biplob018 Shortcode Addons.This issue affects Shortcode Addons: from n/a through 3.2.5...

CVE-2024-31115 WordPress Chauffeur Taxi Booking System for WordPress plugin <= 7.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in QuanticaLabs Chauffeur Taxi Booking System for WordPress.This issue affects Chauffeur Taxi Booking System for WordPress: from n/a through 7.2...

CVE-2024-30510 WordPress Salon booking system plugin <= 9.5 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 9.5...

CVE-2024-30510 WordPress Salon booking system plugin <= 9.5 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 9.5...

CVE-2024-30500 WordPress CubeWP plugin <= 1.1.12 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in CubeWP CubeWP – All-in-One Dynamic Content Framework.This issue affects CubeWP – All-in-One Dynamic Content Framework: from n/a through 1.1.12...

CVE-2024-30500 WordPress CubeWP plugin <= 1.1.12 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in CubeWP CubeWP – All-in-One Dynamic Content Framework.This issue affects CubeWP – All-in-One Dynamic Content Framework: from n/a through 1.1.12...

WordPress Chauffeur Taxi Booking System for WordPress plugin <= 7.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Kursat Cetin Patchstack in WordPress Plugin Chauffeur Taxi Booking System for WordPress versions = 7.2...

WordPress Shortcode Addons <= 3.2.5 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Peng Zhou Patchstack Alliance in WordPress Plugin Shortcode Addons versions = 3.2.5...

WordPress DX-Watermark plugin <= 1.0.4 - CSRF to Arbitrary File Upload and XSS vulnerability

CSRF to Arbitrary File Upload and XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin DX-Watermark versions = 1.0.4...

WordPress Layouts for Elementor plugin < 1.8 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin Layouts for Elementor versions 1.8...

WordPress Layouts for Elementor Plugin < 1.8 is vulnerable to Arbitrary File Upload

Software Layouts for Elementor Type Plugin Vulnerable versions 1.8 Fixed in 1.8 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Upload CVE CVE-2024-30533 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID f5141cd380b2 Credits Abdi Pranata Required...

WordPress Chauffeur Taxi Booking System for WordPress Plugin <= 7.2 is vulnerable to Arbitrary File Upload

Software Chauffeur Taxi Booking System for WordPress Type Plugin Vulnerable versions = 7.2 Fixed in 7.3 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-31115 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 38ac26bee38f Credits luc Required...

WordPress Shortcode Addons Plugin <= 3.2.5 is vulnerable to Arbitrary File Upload

Software Shortcode Addons Type Plugin Vulnerable versions = 3.2.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-31114 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 25bf030daa64 Credits Peng Zhou Required privilege Administrator...

CVE-2024-2890 WordPress Tumult Hype Animations plugin <= 1.9.12 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Tumult Inc. Tumult Hype Animations.This issue affects Tumult Hype Animations: from n/a through 1.9.12...

CVE-2024-2890 WordPress Tumult Hype Animations plugin <= 1.9.12 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Tumult Inc. Tumult Hype Animations.This issue affects Tumult Hype Animations: from n/a through 1.9.12...