CVE-2026-0927: Missing Authorization

The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization checks in the uploadMedicalReport function in all versions up to, and including, 3.6.15. This makes it possible for unauthenticated attackers to upload...

CVE-2026-Pending-Django-Summernote-RCE

CVE-2026-XXXXX Pending: django-summernote Arbitrary File Upl...

CVE-2025-69312 WordPress Xpro Elementor Addons plugin <= 1.4.19.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Upload a Web Shell to a Web Server.This issue affects Xpro Elementor Addons: from n/a through = 1.4.19.1...

CVE-2025-69312 WordPress Xpro Elementor Addons plugin <= 1.4.19.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Upload a Web Shell to a Web Server.This issue affects Xpro Elementor Addons: from n/a through = 1.4.19.1...

CVE-2025-69312

CVE-2025-69312 describes an Unrestricted Upload of File with Dangerous Type in Xpro Elementor Addons (Xpro Addons, 140+ Widgets for Elementor). The flaw allows uploading a Web Shell to the web server, affecting Xpro Elementor Addons versions up to and including 1.4.19.1 (vendor n/a). The issue’s ...

CVE-2025-68986 WordPress Miion theme <= 1.2.7 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Miion miion allows Upload a Web Shell to a Web Server.This issue affects Miion: from n/a through = 1.2.7...

CVE-2025-68986 WordPress Miion theme <= 1.2.7 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Miion miion allows Upload a Web Shell to a Web Server.This issue affects Miion: from n/a through = 1.2.7...

CVE-2025-68986

CVE-2025-68986 affects the WordPress Miion theme (Miion

CVE-2025-68909

CVE-2025-68909 concerns Blogistic WordPress theme (blazethemes) &lt;= 1.0.5 with an Unrestricted Upload of File with Dangerous Type vulnerability. Connected sources (Patchstack/PT-2026-4111, CVE listings) specify arbitrary file upload as the root cause, affecting Blogistic versions up to 1.0.5. P...

CVE-2025-68910 WordPress Blogzee theme <= 1.0.5 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes Blogzee blogzee allows Using Malicious Files.This issue affects Blogzee: from n/a through = 1.0.5...

CVE-2025-68910 WordPress Blogzee theme <= 1.0.5 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes Blogzee blogzee allows Using Malicious Files.This issue affects Blogzee: from n/a through = 1.0.5...

CVE-2025-68910

CVE-2025-68910 pertains to the WordPress Blogzee theme (Blogzee) versions up to and including 1.0.5, with an issue described as Unrestricted Upload of File with Dangerous Type. The vulnerability enables uploading malicious files due to improper file-type validation, exposing impact to the Blogzee...

CVE-2025-68909 WordPress Blogistic theme <= 1.0.5 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes Blogistic blogistic allows Using Malicious Files.This issue affects Blogistic: from n/a through = 1.0.5...

CVE-2025-68909 WordPress Blogistic theme <= 1.0.5 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes Blogistic blogistic allows Using Malicious Files.This issue affects Blogistic: from n/a through = 1.0.5...

CVE-2025-68001

CVE-2025-68001 affects garidium g-FFL Checkout (WordPress plugin) ≤ 2.1.0 and is an Unrestricted Upload of a File with Dangerous Type, enabling a Web Shell upload to the server. Root cause: improper validation/allowance of dangerous file types during upload. Impact: potential remote code executio...

CVE-2025-68001 WordPress g-FFL Checkout plugin <= 2.1.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in garidium g-FFL Checkout g-ffl-checkout allows Upload a Web Shell to a Web Server.This issue affects g-FFL Checkout: from n/a through = 2.1.0...

CVE-2025-68001 WordPress g-FFL Checkout plugin <= 2.1.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in garidium g-FFL Checkout g-ffl-checkout allows Upload a Web Shell to a Web Server.This issue affects g-FFL Checkout: from n/a through = 2.1.0...

CVE-2025-67968

CVE-2025-67968 (WordPress Real Homes CRM plugin) is an arbitrary file upload vulnerability in the realhomes-crm component, affecting Real Homes CRM versions through 1.0.0. The Root Cause described across sources is weak authorization logic that allows uploading files with dangerous types. Public ...

CVE-2025-67968 WordPress Real Homes CRM plugin <= 1.0.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in InspiryThemes Real Homes CRM realhomes-crm allows Using Malicious Files.This issue affects Real Homes CRM: from n/a through = 1.0.0...

CVE-2025-67968 WordPress Real Homes CRM plugin <= 1.0.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in InspiryThemes Real Homes CRM realhomes-crm allows Using Malicious Files.This issue affects Real Homes CRM: from n/a through = 1.0.0...