171 matches found
WordPress Shared Files Pro plugin < 1.7.68 - Unauthenticated Arbitrary File Deletion vulnerability
Unauthenticated Arbitrary File Deletion vulnerability discovered by Huynh Kien Minh in WordPress Plugin Shared Files Pro versions 1.7.68...
WordPress Shared Files plugin < 1.7.67 - Unauthenticated Arbitrary File Deletion vulnerability
Unauthenticated Arbitrary File Deletion vulnerability discovered by Huynh Kien Minh in WordPress Plugin Shared Files versions 1.7.67...
WordPress Shared Files plugin < 1.7.67 - Unauthenticated Limited File Upload vulnerability
Unauthenticated Limited File Upload vulnerability discovered by hoangphuong in WordPress Plugin Shared Files versions 1.7.67...
WordPress Shared Files Pro plugin < 1.7.70 - Unauthenticated Limited File Upload vulnerability
Unauthenticated Limited File Upload vulnerability discovered by hoangphuong in WordPress Plugin Shared Files Pro versions 1.7.70...
CVE-2026-19084
The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL...
CVE-2026-12513
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the...
CVE-2026-12514
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visito...
CVE-2026-19084 Shared Files < 1.7.70 - Unauthenticated Arbitrary File Read
The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL...
CVE-2026-19084
shared-files-pro WordPress plugin versions before 1.7.70 fail to validate the file path supplied when creating a featured image. An unauthenticated attacker can exploit this to read arbitrary files from the server and republish their contents at a public URL, resulting in high confidentiality imp...
EUVD-2026-67569
The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL...
CVE-2026-12513
CVE-2026-12513 affects the Shared Files WordPress plugin (before 1.7.67) and Shared Files Pro (before 1.7.68). The plugins fail to properly sanitize a file path taken from a frontend file submission, and their single-pass traversal filter is bypassable. An unauthenticated user can store a path po...
CVE-2026-12514
The Shared Files WordPress plugin (before 1.7.67 ) and shared-files-pro (before 1.7.70 ) lack a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce rendered on public pages. An unauthenticated visitor can therefore upload file...
EUVD-2026-67566
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visito...
EUVD-2026-67565
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the...
CVE-2026-12514 Shared Files < 1.7.70 - Unauthenticated Limited File Upload
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visito...
CVE-2026-12513 Shared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path Traversal
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the...
CVE-2026-78269
Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...
EUVD-2026-64834
Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...