CVE-2026-74018

Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...

CVE-2026-66600

Author Arbitrary File Upload in Media LIbrary Assistant = 3.39 versions...

EUVD-2026-63318

Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...

CVE-2026-74018

CVE-2026-74018 is an Arbitrary File Upload vulnerability in the WordPress Theme Warehouse Cargo (versions ≤ 2.6.9 ). The vulnerability is accessible to users with Subscriber privileges and carries a CVSS 3.1 score of 9.9 (Critical) , with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicatin...

CVE-2026-74018 WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...

CVE-2026-74014 WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in IT Residence = 3.2.1 versions...

CVE-2026-74014 WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in IT Residence = 3.2.1 versions...

CVE-2026-74016 WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...

EUVD-2026-63316

Subscriber Arbitrary File Upload in IT Residence = 3.2.1 versions...

EUVD-2026-63317

Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...

CVE-2026-74016 WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...

CVE-2026-74014

A Subscriber (low-privileged WordPress user) in the IT Residence theme

CVE-2026-74016

The WordPress Smart Cleaning theme (≤4.8.6) allows any logged-in subscriber to upload arbitrary files, enabling remote code execution. Patchstack reports this as critical (CVSS 9.9) with a fix available in newer theme versions; upgrading the theme is the primary mitigation. No in-the-wild exploit...

CVE-2026-66600 WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability

Author Arbitrary File Upload in Media LIbrary Assistant = 3.39 versions...

CVE-2026-66600

Media Library Assistant WordPress plugin (versions ≤ 3.39) allows users with the Author role to upload arbitrary files, potentially enabling remote code execution. CVSS 9.1 (Critical) reflects network-exploitable, low-complexity attack with full confidentiality, integrity, and availability impact...

CVE-2026-66600 WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability

Author Arbitrary File Upload in Media LIbrary Assistant = 3.39 versions...

EUVD-2026-63341

Author Arbitrary File Upload in Media LIbrary Assistant = 3.39 versions...

WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Denver Jackson in WordPress Theme IT Residence versions = 3.2.1...

CVE-2026-14946

A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise...

CVE-2026-14946

Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to remote code execution due to improper file type validation . A high-privileged remote attacker can upload a .php file and then request it directly from /uploads/.php, leading to arbitrary code execution and potential full system co...