CVE-2026-66665

Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...

CVE-2026-66447

Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...

CVE-2026-66665 WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...

CVE-2026-66665

CVE-2026-66665 affects the WordPress Type Hub plugin (versions

EUVD-2026-53891

Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...

CVE-2026-66665 WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...

CVE-2026-66665

Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...

CVE-2026-66447

Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...

EUVD-2026-53883

Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...

CVE-2026-66447 WordPress WordPress File Upload plugin <= 5.1.7 - SQL Injection vulnerability

Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...

CVE-2026-66447

CVE-2026-66447 : Unauthenticated SQL Injection in WordPress File Upload plugin

CVE-2026-66447 WordPress WordPress File Upload plugin <= 5.1.7 - SQL Injection vulnerability

Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...

WordPress Podlove Podcast Publisher RCE (CVE-2026-13001)

Exploits CVE-2026-13001 in Podlove Podcast Publisher = 4.5.1: serves a GIF89a polyglot built from the configured framework payload, triggers the image-cache fetch shell.php?.gif bypass, then executes the cached PHP via HTTP reversetcp connects back through the normal listener. !/usr/bin/env pytho...

github.com/moby/buildkit: BuildKit: File escape vulnerability allows unauthorized file modification

A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. A malicious client with valid permissions to access the BuildKit control API can craft a special upload request. This request allows files to escape from the BuildKit-controlled state directory, potentially...

WordPress LightSync Pro – Connect & Sync Cloud Assets | Lightroom, Canva, Figma, Dropbox & Shutterstock plugin <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload vulnerability

Authenticated Author+ Arbitrary File Upload vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin LightSync Pro versions = 2.1.6...

WordPress Webinfos plugin <= 1.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Webinfos versions = 1.2...

CVE-2026-18050

The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy,...

CVE-2025-15678 Nexter Blocks < 5.0.2 - Author+ Stored XSS via SVG Upload

The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files Author by default, allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site...

CVE-2026-18050 Events Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads

The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy,...

EUVD-2026-53722

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and...