CVE-2025-12153

CVE-2025-12153 affects the WordPress plugin Featured Image via URL, vulnerable in all versions up to and including 0.1. An authenticated attacker with Contributor-level access or higher can upload arbitrary files to the target site, with remote code execution potential. Wordfence lists the patch ...

EUVD-2025-201372

The Featured Image via URL plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation function in all versions up to, and including, 0.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on...

CVE-2025-12153 Featured Image via URL <= 0.1 - Authenticated (Contributor+) Arbitrary FIle Upload

The Featured Image via URL plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation function in all versions up to, and including, 0.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on...

CVE-2025-12181

ContentStudio plugin for WordPress (versions up to and including 1.3.7) is vulnerable to arbitrary file uploads due to missing file type validation in cstu_update_post(). Authenticated attackers with Author-level access or higher can upload arbitrary files to the server, potentially enabling remo...

CVE-2025-12181 ContentStudio <= 1.3.7 - Authenticated (Author+) Arbitrary File Upload

The ContentStudio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the cstuupdatepost function in all versions up to, and including, 1.3.7. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrar...

CVE-2025-12181 ContentStudio <= 1.3.7 - Authenticated (Author+) Arbitrary File Upload

The ContentStudio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the cstuupdatepost function in all versions up to, and including, 1.3.7. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrar...

CVE-2025-13066

The Demo Importer Plus plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.0.6. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. Th...

CVE-2025-13066

CVE-2025-13066 refers to the WordPress plugin Demo Importer Plus (versions up to and including 2.0.6) with an authenticated file upload flaw: insufficient file-type validation allows WXR files, letting double-extension files bypass sanitization and upload arbitrary files. The vulnerability requir...

CVE-2025-13066 Demo Importer Plus <= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass

The Demo Importer Plus plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.0.6. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. Th...

EUVD-2025-201353

The Demo Importer Plus plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.0.6. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. Th...

CVE-2025-13066 Demo Importer Plus <= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass

The Demo Importer Plus plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.0.6. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. Th...

WordPress plugin Auto Thumbnailer 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A code issue...

Fanvil x210 安全漏洞

The Fanvil x210 is an IP telephony device from Fanvil. A security vulnerability exists in Fanvil x210 V2 version 2.12.20, which originates in the file upload feature and could allow an unauthenticated attacker on the local network to store arbitrary files...

WordPress plugin ContentStudio 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A code issue...

PT-2025-49203

Name of the Vulnerable Software and Affected Versions Auto Thumbnailer WordPress plugin versions prior to 1.0. Description The Auto Thumbnailer plugin for WordPress is susceptible to arbitrary file uploads because of a lack of file type validation within the uploadThumb function. This allows...

CVE-2025-12153: Unrestricted Upload of File with Dangerous Type

The Featured Image via URL plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation function in all versions up to, and including, 0.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on...

CVE-2025-12154: Unrestricted Upload of File with Dangerous Type

The Auto Thumbnailer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadThumb function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload...

CVE-2025-12181: Unrestricted Upload of File with Dangerous Type

The ContentStudio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the cstuupdatepost function in all versions up to, and including, 1.3.7. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrar...

CVE-2025-13066: Unrestricted Upload of File with Dangerous Type

The Demo Importer Plus plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.0.6. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. Th...

rConfig RCE (CVE-2020-10221)

The version of rConfig installed on the remote host is affected by a remote code executionvulnerability, as follows: - The flaw exists due to insufficient input validation in the userAdmin.inc.php component, which allows an unauthenticated attacker to upload arbitrary files to the server. By...