Startklar Elementor Addons < 1.7.14 - Unauthenticated Arbitrary File Upload

Description The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'process' function in the 'startklarDropZoneUploadProcess' class in versions up to, and including, 1.7.13. This makes it possible for...

CVE-2024-4033

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the aiovgcreateattachmentfromexternalimageurl function in all versions up to, and including, 3.6.4. This makes it possible for authenticated attackers, with contributor...

CVE-2024-2667

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for...

CVE-2024-2346

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via folder deletion due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2024-2667

CVE-2024-2667 affects the InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress. The root cause is insufficient file validation in the REST API endpoint /wp-json/instawp-connect/v1/config, affecting all versions up to 0.1.0.22. This enables unauthenticated attackers to upload arbi...

CVE-2024-2667 InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for...

CVE-2024-1567

CVE-2024-1567 affects Royal Elementor Addons and Templates for WordPress. It arises from missing file type validation in file_validity, allowing unauthenticated users to upload unsafe file types (e.g., .svgz) on versions up to 1.3.94. This could enable cross-site scripting or remote code executio...

PT-2024-18138 · WordPress · The Royal Elementor Addons/Templates

Name of the Vulnerable Software and Affected Versions: Royal Elementor Addons and Templates plugin for WordPress versions up to, and including, 1.3.94 Description: The issue is related to missing file type validation in the file validity function, allowing unauthenticated attackers to upload...

WordPress plugin InstaWP Connect 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

MGASA-2024-0155 Updated mediawiki packages fix security vulnerabilities

Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a low-privileged user account can use this exploit to become an administrator by sending a malicious link to the instance administrator...

Znuny和Znuny LTS 安全漏洞

Znuny is a work order system from Znuny, Inc. A security vulnerability exists in Znuny and Znuny LTS that stems from the presence of a path traversal vulnerability. An attacker could exploit the vulnerability to upload a file to an arbitrary writable location. Affected products and versions: Znun...

CVE-2024-3962 Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file

The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppomuploadfile function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files...

CVE-2024-3962 Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file

The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppomuploadfile function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files...

CVE-2024-3962

The CVE CVE-2024-3962 affects Product Addons & Fields for WooCommerce (PPOM) on WordPress. It is caused by missing file type validation in the ppom_upload_file function, allowing unauthenticated arbitrary file uploads on all versions up to and including 32.0.18. Exploitation requires PPOM Pro ins...

EUVD-2024-32528

The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppomuploadfile function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files...

CVE-2024-2920

The CVE-2024-2920 entry concerns the WP-Members Membership Plugin for WordPress, with Information Exposure affecting all versions up to 3.4.9.3. The root cause is that user-uploaded files are placed in a publicly accessible directory under wp-content, allowing unauthenticated attackers to view fi...

PT-2024-24155 · Thinkcmf · Thinkcmf

Name of the Vulnerable Software and Affected Versions: ThinkCMF version 6.0.9 Description: The issue concerns a file upload vulnerability via the UeditorController.php. Recommendations: For ThinkCMF version 6.0.9, consider disabling the file upload functionality via UeditorController.php until a...

WordPress plugin Unlimited Elements For Elementor 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

Royal Elementor Addons and Templates < 1.3.95 - Unauthenticated Limited File Upload

Description The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to limited file uploads due to missing file type validation in the 'filevalidity' function in all versions up to, and including, 1.3.94. This makes it possible for unauthenticated attackers to upload dangerous...

PT-2024-3040 · WordPress · Forminator

Name of the Vulnerable Software and Affected Versions: Forminator versions prior to 1.29.0 Description: The issue is related to an unrestricted upload of files with dangerous types in the Forminator plugin for WordPress. This could allow a remote attacker to upload arbitrary files to the server,...