CVE-2026-13249 Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040

An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication. An attacker could potentially exploit this...

CVE-2026-40487

CVE-2026-40487 - Postiz = 2.21.5 - Arbitrary File Upload via MIME-Type Spoofing to Stored XSS to Account Takeover Discovered & reported by: Astaruf Full writeup: https://nstsec.com/en/posts/postiz-xss-cve-2026-40487/ NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-40487 GHSA entry:...

CVE-2026-15748

CVE-2026-15748 — Forminator Forms Unauthenticated Arbitrary File Upload → RCE CVSS 9.8 Critical · Affected: Forminator = 1.56.1 · Patched: 1.56.2 Researcher: daroo Wordfence Bug Bounty, $2,048 · 600k active installs Writeup:...

CVE-2026-13714

CVE-2026-13714 Realtyna Organic IDX plugin + WPL Real Estate │ │ ├─ privatekey = │ │ ├─ cmd = setproperty │...

CVE-2026-1357

🧨 CVE-2026-1357 – WPvivid Null-Key Exploit Tool CVE-2026-1357.py Migration, Backup, Staging – WPvivid Backup & Migration ≤ 0.9.123 Vulnerability: Unauthenticated Arbitrary File Upload → Remote Code Execution CVE: CVE-2026-1357 – CVSS 9.8 Critical GitHub: https://github.com/Nxploited Telegram:...

CVE-2025-7441

CVE-2025-7441 StoryChief data - sizes - full field pointing to an arbitrary URL. StoryChief does not perform sufficient filetype/content validation or restrict the URL source, allowing the plugin to fetch the remote resource and save it under the site's uploads directory. There is insufficient...

CVE-2025-48148

CVE-2025-48148 StoreKeeper for WooCommerce = 14.4.4 - Unauthenticated Arbitrary File Upload 🚀 StoreKeeper for WooCommerce = 14.4.4 - Unauthenticated Arbitrary File Upload Exploit 📝 Description The StoreKeeper for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to...

CVE-2025-10041

CVE-2025-10041 Flex QR Code Generator = 1.2.5 - Unauthenticated Arbitrary File Upload 🚨 Flex QR Code Generator ≤ 1.2.5 - Unauthenticated Arbitrary File Upload 📝 Description The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation ...

CVE-2024-9290

CVE-2024-9290 Super Backup & Clone - Migrate for WordPress = 2.3.3 - Unauthenticated Arbitrary File Upload Description The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check o...

CVE-2024-5084

Hash Form 9.9.1 file upload vulnerability Exploit The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fileuploadaction' function in all versions up to, and including, 1.1.0. This makes it possible for...

CVE-2025-6440

CVE-2025-6440 WooCommerce Designer Pro CVE: CVE-2025-6440 CVSS: 9.8 Critical 📝 Description The WooCommerce Designer Pro plugin for WordPress, widely used especially in themes such as Pricom - Printing Company & Design Services, is vulnerable to arbitrary file uploads due to a lack of proper file...

CVE-2025-1306

Newscrunch Exploit CVE-2025-1306 🚨 Overview This exploit targets a Cross-Site Request Forgery CSRF to Arbitrary File Upload vulnerability CVE-2025-1306 in the Newscrunch WordPress theme. Due to missing nonce validation in the newscrunchinstallandactivateplugin function, an unauthenticated attacke...

CVE-2024-54262

CVE-2024-54262 Exploit CVE-2024-54262: Arbitrary File Upload in Import Export for WooCommerce Overview This script exploits a vulnerability in the "Import Export for WooCommerce" WordPress plugin. The vulnerability allows unauthorized users to upload arbitrary files, leading to potential remote...

CVE-2024-51793

🛡️ WordPress RepairBuddy Plugin Exploit 📜 CVE Information CVE-ID: CVE-2024-51793 Published: 2024-11-11 Updated: 2024-11-11 Title: WordPress RepairBuddy plugin = 3.8115 - Arbitrary File Upload vulnerability Description: Unrestricted Upload of File with Dangerous Type vulnerability in Webful...

CVE-2025-2249

🔐 WordPress SoJ SoundSlides Plugin ⚠️ DISCLAIMER: This exploit is for educational and authorized testing purposes only. 📌 Vulnerability Summary Plugin: SoJ SoundSlides Affected Versions: = 1.2.2 Type: Authenticated Contributor+ Arbitrary File Upload Patch Status: ❌ No official fix available The So...

CVE-2024-9698

CVE-2024-9698 Crafthemes Demo Import = 3.3 - Arbitrary File Upload Exploit 📌 Overview This exploit targets a critical vulnerability CVE-2024-9698 in the Crafthemes Demo Import plugin for WordPress. The vulnerability allows authenticated administrators to upload arbitrary files to the affected...

CVE-2024-9234

CVE-2024-9234 GutenKit = 2.1.0 - Unauthenticated Arbitrary File Upload POC python CVE-2024-9234.py -h baseurl note This script is provided for educational purposes only. The author is not responsible for any damages caused by the misuse of this script...

CVE-2023-51409

CVE-2023-51409 AI Engine: ChatGPT Chatbot = 1.9.98 - Unauthenticated Arbitrary File Upload via restupload Description This could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website. usage:...

CVE-2024-7985-PoC

CVE-2024-7985-PoC FileOrganizer = 1.0.9 - Authenticated Subscriber+ Arbitrary File Upload FileOrganizer Exploit - CVE-2024-7985 📌 Overview CVE-2024-7985 - WordPress Plugin FileOrganizer = 1.0.9 is vulnerable to authenticated arbitrary file uploads , allowing attackers with Subscriber+ privileges...

CVE-2024-1247-PoC

CVE-2024-1247-PoC Post Saint = 1.3.1 plugin for WordPress Arbitrary File Upload Description The Post Saint plugin for WordPress versions up to and including 1.3.1 is vulnerable to arbitrary file uploads due to missing capability checks and file type validation. Authenticated attackers with at lea...