EUVD-2026-82730

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...

CVE-2026-12106 Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...

CVE-2026-12106

The Auto Upload Images plugin for WordPress (all versions up to and including 3.3.2 ) is vulnerable to a Limited Server-Side Request Forgery (SSRF) via the downloadImage function. The root cause is the use of wp_remote_get() instead of wp_safe_remote_get(), combined with a validate() method that ...

CVE-2026-84738

The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution...

EUVD-2026-82660

The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution...

CVE-2026-84738 AF Companion < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCE

The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution...

CVE-2026-84738

The AF Companion WordPress plugin, in versions before 2.2.0 , contains a vulnerability where it fails to validate file types during one of its import features . This oversight allows users with a low-privileged store-management role to upload arbitrary files, such as PHP files , resulting in Remo...

CVE-2026-84738 AF Companion < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCE

The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution...

PT-2026-95696

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download file to uploads function. This is due to the import action being registered for...

CVE-2026-6205: External Control of File Name or Path

An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks...

CVE-2026-89330: Improper Neutralization of Input During Web Page Generation

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and outpu...

CVE-2026-77929: Unrestricted Upload of File with Dangerous Type

ClipBucket v5 before 5.5.3-182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile function in fileupload.class.php fails to update...

PT-2026-95266

Name of the Vulnerable Software and Affected Versions Auto Upload Images versions prior to 3.3.3 Description This issue is a Limited Server-Side Request Forgery SSRF, a flaw that allows a server to be coerced into making requests to an unintended location. Authenticated attackers with...

CVE-2026-93031: Unrestricted Upload of File with Dangerous Type

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the downloadfiletouploads function. This is due to the import action being registered for...

PT-2026-95397

Name of the Vulnerable Software and Affected Versions SveltyCMS version 0.0.6 Description A remote cross site scripting issue exists within the SVG Media Upload component, specifically affecting the src/utils/media/media-service.server.ts file. Cross site scripting is a technique where malicious...

CVE-2026-12106: Server-Side Request Forgery (SSRF)

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...

CVE-2026-84738: Improper Control of Generation of Code

The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution...

PT-2026-95412

Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.3-182 Description Authenticated users can achieve remote code execution by uploading a PHP file containing valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile function in...

CVE-2026-56590: Unrestricted Upload of File with Dangerous Type

HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthenticated attacker to upload and execute malicious payloads, resulting in a complete server compromise...

CVE-2026-93505: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-service.server.ts of the component SVG Media Upload. Performing a manipulation results in cross site scripting. The attack can be initiated remotely. The patch is named...