WordPress FW Food Menu plugin <= 6.0.0 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by LVT-tholv2k in WordPress Plugin FW Food Menu versions = 6.0.0...

CVE-2025-5012

The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'workreaptempuploadtomedia' function in all versions up to, and including, 3.3.2. This makes it possible for...

CVE-2025-5012 Workreap <= 3.3.2 - Authenticated (Subscriber+) Arbitrary File Upload via 'workreap_temp_upload_to_media'

The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'workreaptempuploadtomedia' function in all versions up to, and including, 3.3.2. This makes it possible for...

CVE-2025-5012

CVE-2025-5012 affects the WordPress Workreap plugin (WordPress theme: Workreap - Freelance Marketplace) up to version 3.3.2. The vulnerability is an arbitrary file upload flaw caused by missing file type validation in the function workreap_temp_upload_to_media , exploitable by authenticated users...

CVE-2025-4387

The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcapaddtocartpopupuploadfiles function in all versions up to, and including, 9.16.0. This makes it possible for an authenticated attacker, with...

CVE-2025-5012: Unrestricted Upload of File with Dangerous Type

The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'workreaptempuploadtomedia' function in all versions up to, and including, 3.3.2. This makes it possible for...

WordPress Ovatheme Events Manager plugin <= 1.8.4 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin Ovatheme Events Manager versions = 1.8.4...

WordPress Reformer for Elementor plugin <= 1.0.5 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Reformer for Elementor versions = 1.0.5...

WordPress Flozen < 1.5.1 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by Phat RiO - BlueRock in WordPress Theme Flozen versions 1.5.1...

CVE-2025-5395 WordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.115.0 - Authenticated (Author+) Arbitrary File Upload

The WordPress Automatic Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'core.php' file in all versions up to, and including, 3.115.0. This makes it possible for authenticated attackers, with Author-level access and above, to...

CVE-2025-5395 WordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.115.0 - Authenticated (Author+) Arbitrary File Upload

The WordPress Automatic Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'core.php' file in all versions up to, and including, 3.115.0. This makes it possible for authenticated attackers, with Author-level access and above, to...

WordPress WordPress Automatic plugin <= 3.115.0 - Authenticated (Author+) Arbitrary File Upload vulnerability

Authenticated Author+ Arbitrary File Upload vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Automatic versions = 3.115.0...

WordPress Axle Demo Importer plugin <= 1.0.3 - Author+ Arbitrary File Upload vulnerability

Author+ Arbitrary File Upload vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Axle Demo Importer versions = 1.0.3...

WordPress Flozen Theme < 1.5.1 is vulnerable to Arbitrary File Upload

Software Flozen Type Theme Vulnerable versions 1.5.1 Fixed in 1.5.1 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2025-49071 Patch priority High CVSS severity High 10 Developer Claim ownership PSID b0bba867fa7b Credits Phat RiO - BlueRock Required privilege Unauthenticat...

CVE-2025-5395: Unrestricted Upload of File with Dangerous Type

The WordPress Automatic Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'core.php' file in all versions up to, and including, 3.115.0. This makes it possible for authenticated attackers, with Author-level access and above, to...

WordPress PT Luxa Addons Plugin <= 1.2.2 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by Bonds in WordPress Plugin PT Luxa Addons versions = 1.2.2...

WordPress WooCommerce Designer Pro Plugin <= 1.9.24 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by Bonds in WordPress Plugin WooCommerce Designer Pro versions = 1.9.24...

CVE-2025-4954

The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users author and above to upload arbitrary files such as PHP on the server...

CVE-2025-4954

The Axle Demo Importer WordPress plugin, affecting versions through 1.0.3 , contains a vulnerability that fails to validate uploaded files. This oversight allows authenticated users with author level privileges or higher to perform arbitrary file uploads , such as PHP files, to the server. The vu...

CVE-2025-4954 Axle Demo Importer <= 1.0.3 - Author+ Arbitrary File Upload

The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users author and above to upload arbitrary files such as PHP on the server...