CVE-2025-4389

CVE-2025-4389 漏洞利用 详细信息 发布日期 : 2025年5月16日 更新日期 : 2025年5月17日 严重性 : 严重（CVSS评分：9.8） CWE : CWE-434: CWE-434 危险类型文件的不受限上传 受影响版本 : 从 n/a 到 2.6.8.1 的所有版本 研究人员 : https://www.wordfence.com/threat-intel/vulnerabilities/researchers/friderika-baranyai CVSS向量 CVSS版本 : 9.8 向量字符串 :...

CVE-2024-43160

Wordpress BerqWP = 1.7.6 - 認証なし任意ファイルアップロード CVE-2024-43160 WordPress用プラグイン「BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and...

CVE-2025-5961

🚨 迁移、备份、暂存 – WPvivid Backup & Migration 📈 此漏洞影响拥有超过700,000+ 次安装 的插件 📝 CVE 详情 CVE: CVE-2025-5961 CVSS: 7.2（高） 发布时间: 2025年7月3日 🔍 描述 用于 WordPress 的 Migration, Backup, Staging – WPvivid Backup & Migration 插件因缺少对 wpvividuploadimportfiles 函数的文件类型验证，导致所有版本（包括 0.9.116）都存在 任意文件上传 漏洞。 这使得...

CVE-2025-3054-Exploit

CVE-2025-3054 エクスプロイト: ここからダウンロード 詳細 CVE ID : CVE-2025-3054 公開日 : 2025年6月5日 CVSS : 8.8 パッチ提供状況 : （公式パッチはまだありません） 影響 WordPress用プラグインWP User Frontend...

CVE-2024-52380

CVE-2024-52380 Picsmize -----------------------------263629263440545280502417734995 Content-Disposition: form-data; name="action"...

CVE-2024-54262

CVE-2024-54262 Import Export For WooCommerce = 1.5 - 認証済み（購読者以上）任意ファイルアップロード 説明 Import Export For WooCommerce WordPressプラグインは、バージョン1.5以前の全バージョンにおいて、ファイルタイプの検証が欠如しているため、任意のファイルアップロードに対して脆弱です。この脆弱性により、購読者レベル以上のアクセス権を持つ認証済み攻撃者が、影響を受けるサイトのサーバー上に任意のファイルをアップロードでき、リモートコード実行が可能になる可能性があります。 詳細 タイプ : plugi...

CVE-2024-50510

CVE-2024-50510 AR For Woocommerce = 6.2 - 未经身份验证的任意文件上传 描述 WordPress 的 AR for WooCommerce 插件在所有版本（包括 6.2）中由于缺少文件类型验证，容易受到任意文件上传攻击。这使得未经身份验证的攻击者可以在受影响站点的服务器上上传任意文件，从而可能导致远程代码执行。 详细信息 类型 : plugin 标识符 : ar-for-woocommerce 受影响版本 : 6.2 CVSS 分数 : 9.8 CVSS 评级 : 严重 CVSS 向量 :...

CVE-2026-8778 MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Upload

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the miplwcuploadfile function in all versions up to, and including, 1.2.1. This makes it possible for...

EUVD-2026-75934

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the miplwcuploadfile function in all versions up to, and including, 1.2.1. This makes it possible for...

CVE-2025-48148

CVE-2025-48148 StoreKeeper for WooCommerce = 14.4.4 - 認証なし任意ファイルアップロード 🚀 StoreKeeper for WooCommerce = 14.4.4 - 認証なし任意ファイルアップロードエクスプロイト 📝 説明 StoreKeeper for WooCommerce WordPress プラグインは、14.4.4 までの全バージョンにおいてファイルタイプの検証が欠如しているため、任意ファイルアップロードに対して脆弱です。...

CVE-2026-75865

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saasuploadlogo function combined with an authorization bypass on the WPLP connector REST endpoin...

CVE-2026-75865 WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saasuploadlogo function combined with an authorization bypass on the WPLP connector REST endpoin...

EUVD-2026-57082

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

CVE-2026-6147

The LightSync Pro WordPress plugin is affected by an insecure file upload vulnerability due to missing file type validation in rest_replace_media() in all versions up to and including 2.1.6. The flaw allows authenticated attackers with Author-level access or higher to upload arbitrary files on th...

CVE-2026-6147 LightSync Pro <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload

The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the restreplacemedia function in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload...

CVE-2026-1771

The MapSVG WordPress plugin is affected up to version 8.14.0. The vulnerability stems from missing file type validation in the SVGFile constructor (due to an incorrect conditional check), allowing authenticated attackers with Administrator+ access to upload arbitrary files via the SVGFile upload ...

CVE-2026-57311

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other...

CVE-2026-15282

The Instant Appointment plugin for WordPress (affected versions up to 1.2) is vulnerable to arbitrary file uploads due to missing file type validation in the insapp_upload_image_as_attachment function. This allows unauthenticated attackers to upload arbitrary files to the server, with a potential...

CVE-2026-4883 Piotnet Forms <= 2.1.40 - Unauthenticated Arbitrary File Upload via Form File Upload

The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'piotnetformsajaxformbuilder' function in all versions up to, and including, 2.1.40. The plugin uses an incomplete extension blacklist that only blocks php, phpt, php5, php7, a...

EUVD-2026-22830

The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ioimgupload function in all versions up to, and including, 1.2024. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which...