78 matches found
VulnCheck KEV: CVE-2025-13516
The SureMail – SMTP and Email Logs Plugin for WordPress is vulnerable to Unrestricted Upload of File with Dangerous Type in versions up to and including 1.9.0. This is due to the plugin's savefile function in inc/emails/handler/uploads.php which duplicates all email attachments to a web-accessibl...
CVE-2015-4133
CVE-2015-4133 usage: CVE-2015-4133.py -h --RHOST RHOST --RPORT RPORT -v YEAR MONTH FILE ReFlex Gallery WordPress plugin = 3.1.3 CVE-2015-4133 PoC. Reference: https://nvd.nist.gov/vuln/detail/CVE-2015-4133 positional arguments: YEAR wp-content/uploads sub directory MONTH wp-content/uploads sub...
CVE-2026-120513
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the removecsvfileafteremailsend function in all versions up to, and including, 3.6.2 This makes it possible fo...
CVE-2026-120513
The Everest Forms WordPress plugin (versions up to and including 3.6.2 ) is vulnerable to unauthenticated arbitrary file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function. Attackers can delete files within the wp-content/uploads directory, potentia...
EUVD-2026-120824
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the removecsvfileafteremailsend function in all versions up to, and including, 3.6.2 This makes it possible fo...
CVE-2026-120513 Everest Forms <= 3.6.2 - Unauthenticated Arbitrary File Deletion via 'everest_forms_{form_id}_old_{field_id}' Parameter
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the removecsvfileafteremailsend function in all versions up to, and including, 3.6.2 This makes it possible fo...
CVE-2026-120513: wpeverest: The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is…
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the removecsvfileafteremailsend function in all versions up to, and including, 3.6.2 This makes it possible fo...
WordPress Plugin: everest-forms: CVE-2026-120513: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the removecsvfileafteremailsend function in all versions up to, and including, 3.6.2 This makes it possible fo...
PT-2026-141545
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove csv file after email send function in all versions up to, and including, 3.6.2 This makes it possib...
CVE-2026-120548
The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the 'y4ymcheckaction' parameter. This makes it possible for unauthenticated attackers to extract the merchant's plaintext Yandex Market API key written t...
EUVD-2026-119032
The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the 'y4ymcheckaction' parameter. This makes it possible for unauthenticated attackers to extract the merchant's plaintext Yandex Market API key written t...
CVE-2026-120555
The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.62.0 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...
EUVD-2026-118560
The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.62.0 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...
CVE-2026-116617 Motors <= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all versions up to, and including, 1.4.128 The vulnerability exists because stmsaveuserextrafields, hooked to personaloptionsupdate, writes the attacker-controlled stmdealerlogopath...
CVE-2026-116617
The Motors – Car Dealership & Classified Listings Plugin for WordPress is vulnerable to File Deletion in all versions up to and including 1.4.128 . The flaw exists because the stm_save_user_extra_fields() function writes the attacker-controlled stm_dealer_logo_path parameter directly to user meta...
CVE-2026-5461
The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete file...
EUVD-2026-113708
The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete file...
CVE-2026-5461 Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata
The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete file...
CVE-2026-5461
The Forminator Forms plugin for WordPress (versions up to and including 1.55.0.2 ) is vulnerable to Limited File Deletion . The root cause is the lack of proper validation for upload field metadata received via POST requests during draft submissions. An unauthenticated attacker can submit a poiso...
CVE-2026-5461 Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata
The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete file...