CVE-2026-15748: Unrestricted Upload of File with Dangerous Type

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handlefileupload function. This is due to insufficient file type validation in handlefileupload, where the dangerous-extension blocklist performs exact-key matchin...

Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites. The vulnerability, tracked as CVE-2026-15748 , is rated 9.8 out of 10.0 on the CVSS...

CVE-2022-36303

Vesta v1.0.0-5 was discovered to contain a cross-site scripting XSS vulnerability via the handlefileupload function at /web/api/v1/upload/UploadHandler.php...

CVE-2022-36303

Vesta, version 1.0.0-5, contains a cross-site scripting (XSS) vulnerability in the handle_file_upload function of /web/api/v1/upload/UploadHandler.php. Root cause: unsafely handling uploaded content enables script execution. Impact, per CVE metrics, is limited to confidentiality and integrity wit...