128 matches found
CVE-2026-103367
The ShopMagic – email automation for WordPress plugin is vulnerable to an Unauthenticated Local File Inclusion (LFI) in all versions up to and including 4.9.0 . The vulnerability exists via the billing_address.first_name parameter, where a lack of proper input sanitization allows attackers to inc...
CVE-2026-93550
The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress...
EUVD-2026-96794
The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress...
PT-2026-110067
The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress...
CVE-2026-104899 GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'designtype' parameter parameter. This makes it possible for unauthenticated attackers to include and...
CVE-2025-15700
The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly...
CVE-2026-75028
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the template scope function. This makes it possible for authenticated attackers, with contributor-level access and...
CVE-2026-75028
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 3.0.18 . The vulnerability exists within the (template scope) function , specifically related to the 'food_menu_style' Ele...
EUVD-2026-89469
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...
CVE-2026-70356
The Toptech TMS7 and TopHAT systems are vulnerable to an unrestricted file upload flaw in the TMS file upload endpoint . Due to a lack of server-side file type restrictions , an attacker with high privileges can upload and execute arbitrary PHP files on the web server. This vulnerability has a CR...
CVE-2026-70356 Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...
PT-2026-102904
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...
CVE-2026-70356: Unrestricted Upload of File with Dangerous Type
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...
CVE-2026-13456: Improper Control of Filename for Include/Require Statement in PHP Program
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with...
PT-2026-97160
Name of the Vulnerable Software and Affected Versions YAHMAN Add-ons WordPress plugin versions prior to 0.9.31 Description The plugin fails to validate the type of remote files it caches within a publicly accessible directory. This allows unauthenticated attackers to write arbitrary PHP files to...
CVE-2026-52607
A directory traversal vulnerability in reportico-web = 8.1.0 allows remote attackers to expose or execute arbitrary php files on the web server by specifying the filename in the targetformat parameter in conjunction with the executemode=EXECUTE parameter of the run.php endpoint...
CVE-2026-16250 Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload
The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution...
CVE-2026-17605
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaidpaymentformelement function. This makes it possible for authenticated attackers, with administrator-level acces...
PT-2026-67127
Name of the Vulnerable Software and Affected Versions Payment forms, Buy now buttons, and Invoicing System | GetPaid versions prior to 2.8.57 Description The plugin is susceptible to Local File Inclusion, a condition where an application includes files from the local file system without proper...
WordPress Campress Theme <= 1.35 - Unauthenticated Local File Inclusion Detection
Campress theme for WordPress up to 1.35 contains a local file inclusion caused by 'campresswoocommercegetajaxproducts' function, letting unauthenticated attackers include and execute arbitrary PHP files, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Campress the...