CVE-2026-84171 WP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File Upload

The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server...

EUVD-2026-76795

The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server...

CVE-2026-81090 Gpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF

The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution...

WordPress Teddy Bear Customize Addon plugin <= 1.0.5 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by 0xBassia in WordPress Plugin Teddy Bear Customize Addon versions = 1.0.5...

CVE-2026-14560

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...

CVE-2026-14560

The teddy-bear-customize-addon WordPress plugin through version 1.0.5 is vulnerable to unauthenticated arbitrary file upload . The plugin does not properly validate uploaded files—it relies on a client-supplied content type and preserves the original filename —allowing an attacker to upload a mal...

EUVD-2026-75959

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...

CVE-2026-14560 Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...

CVE-2026-14560 Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...

CVE-2026-8778

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the miplwcuploadfile function in all versions up to, and including, 1.2.1. This makes it possible for...

CVE-2026-8778

The MIPL Grouped Checkout Fields for WooCommerce WordPress plugin is vulnerable to an unauthenticated arbitrary file upload caused by missing file type validation in the mipl_wc_upload_file function. The flaw affects all versions up to and including 1.2.2 (noted as 1.2.1 in the CVE record), allow...

CVE-2026-8778 MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Upload

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the miplwcuploadfile function in all versions up to, and including, 1.2.1. This makes it possible for...

WordPress MIPL Grouped Checkout Fields for WooCommerce plugin <= 1.2.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Farrukh Ziyaev in WordPress Plugin MIPL Grouped Checkout Fields for WooCommerce versions = 1.2.2...

CVE-2026-18351

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementorfileupload function. This is due to insufficient file type validation in the isfiletypevalid function, which uses the...

EUVD-2026-75229

BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed may be caused...

CVE-2026-84063

BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed may be caused...

CVE-2026-18351 Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementorfileupload function. This is due to insufficient file type validation in the isfiletypevalid function, which uses the...

EUVD-2026-75227

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementorfileupload function. This is due to insufficient file type validation in the isfiletypevalid function, which uses the...

CVE-2026-18351

The Drag and Drop File Upload for Elementor Forms WordPress plugin is vulnerable to an unauthenticated arbitrary file upload in versions up to and including 1.6.0 . The root cause lies in the is_file_type_valid() function, which uses the attacker-controlled type parameter as regex keys within the...

PT-2026-89200

🚨 CRITICAL WORDPRESS RCE — A NEW CVSS 9.8 FLAW CAN LET UNAUTHENTICATED ATTACKERS UPLOAD EXECUTABLE FILES. CVE-2026-18351 affects Drag and Drop File Upload for Elementor Forms ≤1.6.0. No login. No user interaction. CyberSignal Priority: 🔴 VERY HIGH 1/8 The flaw is in the plugin's file-upload...