CVE-2024-13784

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2026-16099

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the createlinkitem function in all versions up to, and including, 4.5.3. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2026-14524

The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSolfileDeleteProcess function in all versions up to, and including, 2.0.8. This makes it possible for unauthenticated attackers to delete arbitrary files on t...

EUVD-2026-59858

The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSolfileDeleteProcess function in all versions up to, and including, 2.0.8. This makes it possible for unauthenticated attackers to delete arbitrary files on t...

CVE-2026-14524

The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSolfileDeleteProcess function in all versions up to, and including, 2.0.8. This makes it possible for unauthenticated attackers to delete arbitrary files on t...

CVE-2026-14524 ProSolution WP Client <= 2.0.8 - Unauthenticated Arbitrary File Deletion via 'newfilename' and 'filename' Parameters

The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSolfileDeleteProcess function in all versions up to, and including, 2.0.8. This makes it possible for unauthenticated attackers to delete arbitrary files on t...

CVE-2026-14524

The CVE concerns the ProSolution WP Client plugin for WordPress, where the proSol_fileDeleteProcess function allows arbitrary file deletion in all versions up to 2.0.8 due to insufficient file path validation. An unauthenticated attacker can delete arbitrary server files by first poisoning their ...

CVE-2026-16099

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the createlinkitem function in all versions up to, and including, 4.5.3. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2026-16099

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to 4.5.3 due to insufficient file path validation in create_link_item. Authenticated attackers with contributor-level access can delete arbitrary server files, potentially enabling remot...

EUVD-2026-59854

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the createlinkitem function in all versions up to, and including, 4.5.3. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2026-16099 Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' Parameter

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the createlinkitem function in all versions up to, and including, 4.5.3. This makes it possible for authenticated attackers, with contributor-level access and...

PT-2026-73086

The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSol fileDeleteProcess function in all versions up to, and including, 2.0.8. This makes it possible for unauthenticated attackers to delete arbitrary files on...

PT-2026-73096

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create link item function in all versions up to, and including, 4.5.3. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2026-18855

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the lldeletelinkfields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, whic...

CVE-2026-18855

The CVE refers to the WordPress Link Library plugin (versions up to 7.9.4) with a vulnerability in the ll_delete_link_fields/ll delete link fields function that allows unauthenticated arbitrary file deletion due to insufficient file path validation. This can lead to remote code execution if a cri...

CVE-2026-18855

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the lldeletelinkfields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, whic...

EUVD-2026-59784

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the lldeletelinkfields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, whic...

CVE-2026-18855 Link Library <= 7.9.4 - Unauthenticated Arbitrary File Deletion via link_url Parameter

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the lldeletelinkfields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, whic...

CVE-2026-14484

The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attacker...

CVE-2026-14484 RapiSafe <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters

The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attacker...