EUVD-2026-60899

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

CVE-2026-32463

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

CVE-2026-32463 WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

CVE-2026-32463

CVE-2026-32463 is an arbitrary file upload vulnerability in the WordPress plugin Sync Post With Other Site , affecting versions 1.9.3 and below . The flaw allows a user with Contributor privileges (low privilege) to upload arbitrary files, which can lead to full site compromise. The CVSS 3.1 scor...

CVE-2026-28192 WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro = 7.1.67 versions...

CVE-2026-28192

The Piotnet Addons For Elementor Pro WordPress plugin (versions ≤ 7.1.67) allows unauthenticated arbitrary file upload, enabling remote code execution with CVSS 9.6 (Critical). Patchstack assigned PT-2026-77033; CISA SSVC rates technical impact as total with no known exploitation yet. Upgrade bey...

CVE-2026-28192 WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro = 7.1.67 versions...

EUVD-2026-60891

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro = 7.1.67 versions...

CVE-2026-28192

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro = 7.1.67 versions...

WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by daroo in WordPress Plugin Templatiq versions = 0.2.5...

WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability

WordPress Masteriyo - LMS plugin = 2.3.2 - Arbitrary File Upload vulnerability discovered by 20kilograma in WordPress Plugin Masteriyo - LMS versions = 2.3.2...

CVE-2026-74902

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access...

CVE-2026-75832 Grav API Plugin before 1.0.14 Authorization Bypass

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0 before version 1.0.14 fixed in 1.0.15 contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope. The method gates the users/ scope on the account's raw super-admin ACL flag access.api.super instead ...

CVE-2026-74908 Grav plugin-api before 1.0.15 Script Injection via SVG

Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing...

EUVD-2026-60589

Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing...

CVE-2026-74908

Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing...

CVE-2026-74902

SiYuan (note-taking app) before v3.7.4 has a file upload validation flaw: filenames are inserted into HTML via insertAdjacentHTML without escaping. A crafted filename carrying script payloads triggers XSS that escalates to full OS command access when a victim drags, drops, or pastes the file into...

EUVD-2026-60583

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access...

CVE-2026-74902

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access...

CVE-2026-74902 SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access...