EUVD-2026-57095

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server,...

CVE-2026-18048

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server,...

CVE-2026-18048

The WP Photo Album Plus WordPress plugin, prior to version 9.2.07.002, fails to validate a client-controlled value used to build a file path in a public endpoint action and does not perform an authorization check. This allows unauthenticated attackers to delete arbitrary ZIP archives on the serve...

CVE-2026-33922

A flaw was found in Arc. This path traversal vulnerability exists within the Offline archives functionality of the local web interface. A local user with administrative credentials can exploit this by submitting an archive name containing special characters, allowing them to delete arbitrary file...

CVE-2026-19091

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleterevision function in all versions up to, and including, 2.8.169. This makes it possible for...

CVE-2026-16230

The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the deletefile function in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to delete files on the server by supplying an...

CVE-2026-19091

The GeoDirectory WordPress plugin (GeoDirectory – WP Business Directory Plugin and Classified Listings Directory)

EUVD-2026-56929

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleterevision function in all versions up to, and including, 2.8.169. This makes it possible for...

CVE-2026-19091

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleterevision function in all versions up to, and including, 2.8.169. This makes it possible for...

CVE-2026-19091 GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleterevision function in all versions up to, and including, 2.8.169. This makes it possible for...

CVE-2026-19091 GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleterevision function in all versions up to, and including, 2.8.169. This makes it possible for...

CVE-2026-16230

The CVE concerns the Formidable Digital Signatures plugin for WordPress, where the delete_file function fails to validate file paths in all versions up to 3.0.6. This allows unauthenticated attackers to delete files on the server by submitting an attacker-controlled filename via item_meta[field_i...

EUVD-2026-56928

The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the deletefile function in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to delete files on the server by supplying an...

CVE-2026-16230

The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the deletefile function in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to delete files on the server by supplying an...

CVE-2026-16230 Formidable Digital Signatures <= 3.0.6 - Unauthenticated Arbitrary File Deletion via Signature Field

The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the deletefile function in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to delete files on the server by supplying an...

WordPress GeoDirectory plugin <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision vulnerability

Authenticated Subscriber+ Arbitrary File Deletion via 'posttype' Parameter via Query-String Bypass in geodirsavepost + geodirdeleterevision vulnerability discovered by mak3bread in WordPress Plugin GeoDirectory versions = 2.8.169...

CVE-2026-72604

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...

CVE-2026-72604 Intelliants Subrion CMS - Path Traversal

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...

CVE-2026-72604 Intelliants Subrion CMS - Path Traversal

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...

EUVD-2026-56043

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...