WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Piotnet Addons For Elementor Pro versions = 7.1.67...

Exploit for CVE-2026-14282

CVE-2026-14282 — GoDAM WordPress Plugin RCE Author: null...

CVE-2026-15039

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

CVE-2026-15039

The Gift Cards For WooCommerce Pro WordPress plugin (versions

CVE-2026-15039 Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

EUVD-2026-57082

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

CVE-2026-15039 Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

CVE-2026-15039

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

CVE-2026-48763

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at GET /api/v1/typebots/typebotId/blocks/blockId/storage/upload-url that accepts an attacker-controlled filePath and returns a presigned S3 PUT URL for that exact key. Because the endpoint only...

CVE-2026-48763 TypeBot has Arbitrary S3 Object Write in deprecated public upload endpoint via attacker-controlled filePath

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at GET /api/v1/typebots/typebotId/blocks/blockId/storage/upload-url that accepts an attacker-controlled filePath and returns a presigned S3 PUT URL for that exact key. Because the endpoint only...

PT-2026-70924

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at GET /api/v1/typebots/typebotId/blocks/blockId/storage/upload-url that accepts an attacker-controlled filePath and returns a presigned S3 PUT URL for that exact key. Because the endpoint only...

Blocksy Companion 2.1.46 - RCE

!/usr/bin/env python3 Exploit Title: Blocksy Companion 2.1.46 - RCE CVE: CVE-2026-58480 Date: 2026-07-13 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram: @banyamersecurity Author GitHub: https://github.com/mbanyamer Author Blog : https://banyamersecurity.com/blog/ Vendor...

Podlove Podcast Publisher 4.5.1 Shell Upload

A proof of concept exploit for an unauthenticated arbitrary file upload vulnerability leading to remote code execution in Podlove Podcast Publisher version 4.5.1. The vulnerability uses inconsistent parsing of an attacker-controlled source URL, allowing a GIF/PHP polyglot to pass file-type...

Blocksy Companion 2.1.46 Shell Upload

Blocksy Companion version 2.1.46 suffers from an unauthenticated arbitrary file upload and double-extension bypass that allows for shell uploads. !/usr/bin/env python3 Exploit Title: Blocksy Companion 2.1.46 - RCE CVE: CVE-2026-58480 Date: 2026-07-13 Exploit Author: Mohammed Idrees Banyamer Autho...

CVE-2026-19089 Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remot...

CVE-2026-19089 Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remot...

CVE-2026-19089

The Product Input Fields for WooCommerce WordPress plugin (versions prior to 2.0.2 ) is vulnerable to an unauthenticated arbitrary file upload due to a lack of file type validation. If the accepted-types setting is left empty—a configuration documented to accept all files—attackers can upload arb...

CVE-2026-16985 Squeeze < 1.7.12 - Author+ Arbitrary File Upload

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

CVE-2026-16985 Squeeze < 1.7.12 - Author+ Arbitrary File Upload

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

The vulnerability of the trx_addons plugin of the WordPress content management system allows a hacker to upload arbitrary files.

The vulnerability of the trxaddons plugin of the WordPress content management system is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to load any files remotely...