WordPress plugin WordPress File Search 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-23867: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in markcoker WordPress File Search wpfilesearch allows Reflected XSS.This issue affects WordPress File Search: from n/a through = 1.2...

CVE-2024-9939

The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.13 via wfufiledownloader.php. This makes it possible for unauthenticated attackers to read files outside of the originally intended directory...

CVE-2024-9939

CVE-2024-9939 (WordPress File Upload plugin) is a path traversal vulnerability that affects WordPress File Upload up to version 4.24.13 via wfu_file_downloader.php, enabling unauthenticated attackers to read files outside the intended directory. The issue is confirmed in connected Red Hat and Wor...

CVE-2024-9939 WordPress File Upload <= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php

The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.13 via wfufiledownloader.php. This makes it possible for unauthenticated attackers to read files outside of the originally intended directory...

CVE-2024-9939 WordPress File Upload <= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php

The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.13 via wfufiledownloader.php. This makes it possible for unauthenticated attackers to read files outside of the originally intended directory...

CVE-2024-11613

The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to, and including, 4.24.15 via the 'wfufiledownloader.php' file. This is due to lack of proper sanitization of the 'source' parameter and...

CVE-2024-9939: Improper Limitation of a Pathname to a Restricted Directory

The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.13 via wfufiledownloader.php. This makes it possible for unauthenticated attackers to read files outside of the originally intended directory...

CVE-2024-11613: Improper Control of Generation of Code

The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to, and including, 4.24.15 via the 'wfufiledownloader.php' file. This is due to lack of proper sanitization of the 'source' parameter and...

CVE-2024-11635: Improper Control of Generation of Code

The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.12 via the 'wfuABSPATH' cookie parameter. This makes it possible for unauthenticated attackers to execute code on the server...

WordPress plugin WordPress File Upload 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

CVE-2024-12719 WordPress File Upload <= 4.24.15 - Missing Authorization to Authenticated (Subscriber+) Limited Path Traversal

The WordPress File Upload plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wfuajaxactionreadsubfolders' function in all versions up to, and including, 4.24.15. This makes it possible for authenticated attackers, with Subscriber-level acce...

CVE-2024-12719

CVE-2024-12719 relates to the WordPress File Upload plugin for WordPress. A missing capability check in the wfu_ajax_action_read_subfolders function across all versions up to 4.24.15 allows authenticated users with Subscriber+ privileges to perform limited path traversal to view directories and s...

WordPress plugin WordPress File Upload 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-1667

Name of the Vulnerable Software and Affected Versions WordPress File Upload plugin versions up to, and including, 4.24.15 Description The WordPress File Upload plugin is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion due to the lack of proper sanitization of...

PT-2025-3736

Name of the Vulnerable Software and Affected Versions WordPress File Upload plugin versions up to 4.24.13 Description The WordPress File Upload plugin is vulnerable to Path Traversal, allowing unauthenticated attackers to read files outside of the originally intended directory through wfu file...

CVE-2024-12719: Missing Authorization

The WordPress File Upload plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wfuajaxactionreadsubfolders' function in all versions up to, and including, 4.24.15. This makes it possible for authenticated attackers, with Subscriber-level acce...

PT-2024-17720 · WordPress · Wordpress File Upload

Name of the Vulnerable Software and Affected Versions: WordPress File Upload plugin versions up to, and including, 4.24.15 Description: The WordPress File Upload plugin is vulnerable to unauthorized access of data due to a missing capability check on the wfu ajax action read subfolders function...

CVE-2024-39639

CVE-2024-39639 affects WordPress File Upload plugin (≤4.24.7). Root cause is Broken Access Control, with Patchstack noting CSRF involvement. Impact is reported as low to medium (CVSS 3.5–4.3 range); patched in version 4.24.8. No exploitation status provided in the sources; monitor for updates fro...

CVE-2024-39639 WordPress File Upload plugin <= 4.24.7 - Broken Access Control + CSRF vulnerability

Broken Access Control vulnerability in Nickolas Bossinas WordPress File Upload allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress File Upload: from n/a through 4.24.7...