EUVD-2025-197965

The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.1.2. This is due to insufficient file type validation detecting ICO files, allowing double extension files with the appropriate magic bytes to bypass sanitizati...

CVE-2025-41735

A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution...

CVE-2025-41735

CVE-2025-41735 affects METZ CONNECT EWIO2-M, EWIO2-M-BM, and EWIO2-BM devices. A low-privilege, unauthenticated remote attacker can upload arbitrary files to arbitrary locations due to missing file checks, potentially enabling remote code execution. The incident is corroborated by multiple source...

CVE-2025-41735 Possible arbitrary file upload

A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution...

CVE-2025-41735 Possible arbitrary file upload

A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution...

CVE-2025-13069

The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.1.3. This is due to insufficient file type validation detecting ICO files, allowing double extension files with the appropriate magic bytes to bypass sanitizati...

EUVD-2025-197938

The WP Dropzone plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 1.1.0 via the ajaxuploadhandle function. This is due to the chunked upload functionality writing files directly to the uploads directory before any file type validation...

CVE-2025-13069 Enable SVG, WebP, and ICO Upload <= 1.1.3 - Authenticated (Author+) Arbitrary File Upload via ICO Upload Bypass

The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.1.3. This is due to insufficient file type validation detecting ICO files, allowing double extension files with the appropriate magic bytes to bypass sanitizati...

CVE-2025-13069

CVE-2025-13069 affects the WordPress plugin Enable SVG, WebP, and ICO Upload, up to and including version 1.1.3 (patched). The issue is an authenticated Arbitrary File Upload via ICO Upload Bypass caused by insufficient ICO file type validation, which lets an attacker with author-level access upl...

CVE-2025-12528

The Pie Forms for WP plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6 via the formatclassic function. This is due to insufficient file type validation where the validateclassic method validates file extensions and sets error messages but does n...

CVE-2025-12775

The WP Dropzone plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 1.1.0 via the ajaxuploadhandle function. This is due to the chunked upload functionality writing files directly to the uploads directory before any file type validation...

CVE-2025-12775 WP Dropzone <= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Upload

The WP Dropzone plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 1.1.0 via the ajaxuploadhandle function. This is due to the chunked upload functionality writing files directly to the uploads directory before any file type validation...

CVE-2025-12775

CVE-2025-12775 concerns the WP Dropzone WordPress plugin (versions up to 1.1.0). Authenticated attackers with subscriber-level access can upload arbitrary files via the chunked upload path handled by ajax_upload_handle, because files are written directly to the uploads directory before any file t...

CVE-2025-12775 WP Dropzone <= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Upload

The WP Dropzone plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 1.1.0 via the ajaxuploadhandle function. This is due to the chunked upload functionality writing files directly to the uploads directory before any file type validation...

EUVD-2025-197948

The Pie Forms for WP plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6 via the formatclassic function. This is due to insufficient file type validation where the validateclassic method validates file extensions and sets error messages but does n...

CVE-2025-12528

CVE-2025-12528 concerns the Pie Forms for WP WordPress plugin (versions &lt;= 1.6). The issue is an Arbitrary File Upload due to insufficient file-type validation: validate_classic checks extensions but does not stop the upload, enabling unauthenticated attackers to upload dangerous extensions (e...

CVE-2025-12528 Pie Forms for WP <= 1.6 - Unauthenticated Arbitrary File Upload

The Pie Forms for WP plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6 via the formatclassic function. This is due to insufficient file type validation where the validateclassic method validates file extensions and sets error messages but does n...

CVE-2025-12528 Pie Forms for WP <= 1.6 - Unauthenticated Arbitrary File Upload

The Pie Forms for WP plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6 via the formatclassic function. This is due to insufficient file type validation where the validateclassic method validates file extensions and sets error messages but does n...

WordPress Enable SVG, WebP, and ICO Upload plugin <= 1.1.2 - Authenticated (Author+) Arbitrary File Upload via ICO Upload Bypass vulnerability

Authenticated Author+ Arbitrary File Upload via ICO Upload Bypass vulnerability discovered by mikemyers in WordPress Plugin Enable SVG, WebP & ICO Upload versions = 1.1.2...

CVE-2025-12974 Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in all versions up to, and including, 2.9.21.1. This is due to the extension blacklist not including .phar files, which can be uploaded through...