CVE-2026-92895

The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.2.1 via the downloadonefile function. This is due to missing file extension whitelist and MIME type validation in downloadonefile when writing files derived from...