CVE-2026-73629

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipityurlallowed filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address...

PT-2026-71689

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a require once directive added to fluentformpro.php...

CVE-2026-16985

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

CVE-2026-16985

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

EUVD-2026-55014

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

CVE-2026-16985

CVE-2026-16985 – Squeeze WordPress plugin (

CVE-2026-16993

The CVE-2026-16993 entry concerns the DHL Shipping Germany for WooCommerce WordPress plugin (pre-4.0.1). The root cause is that the plugin’s shipping-label storage directory is not protected by server-independent access control and relies solely on an Apache .htaccess file. On servers that do not...

CVE-2026-16993 DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess such as nginx an unauthenticated visitor...

CVE-2026-70593

CVE-2026-70593 affects Ghost (Node.js) versions 0.10.0–6.54.1. A vulnerability in custom themes allows a staff user to write files outside the uploads directory via path traversal in LocalStorageBase and theme storage name handling, enabling modification of installation behavior. The issue is fix...

CVE-2026-70593 Ghost: Theme Upload Path Traversal

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBas...

EUVD-2026-52977

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBas...

CVE-2026-16548

The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an...

EUVD-2026-52601

The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an...

CVE-2026-16548 Bit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload via Response Endpoint

The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an...

CVE-2026-16548 Bit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload via Response Endpoint

The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an...

CVE-2026-16548

CVE-2026-16548 affects the WordPress plugin “The Chat Widget: Floating Customer Support Button” (prior to version 1.8.2). The issue is an unauthenticated file upload vulnerability at the plugin’s public response endpoint: it does not validate the uploaded file’s type, extension, content, or size,...

CVE-2026-16548

The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an...

EUVD-2026-52168

The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files including PHP to a web-accessible directory, leading to...

CVE-2026-12872

The CVE-2026-12872 entry concerns the Webinfos WordPress plugin (

CVE-2026-13157

The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload executable...