Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,631

Export CSV
CVE-2021-25119

AGIL <= 1.0 - Admin+ Arbitrary File Upload

The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Wpsocket
Products
Automatic Grid Image Listing
CVE-2021-25003

WPCargo < 6.9.0 - Unauthenticated RCE

The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE

CVSS 3.1 · 9.8 Critical EPSS 56.1% KEV · Not listed
Vendors
Wptaskforce
Products
Wpcargo Track \& Trace
CVE-2021-24981

Directorist – Business Directory Plugin < 7.0.6.2 - CSRF to Remote File Upload

The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Wpwax
Products
Directorist
CVE-2021-24960

WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVG

The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Iptanus
Products
Wordpress File Upload Wordpress File Upload Pro
CVE-2021-24947

RVM - Responsive Vector Maps < 6.4.2 - Subscriber+ Arbitrary File Read

The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server

CVSS 3.1 · 6.5 Medium EPSS 3.1% KEV · Not listed
Vendors
Thinkupthemes
Products
Responsive Vector Maps
CVE-2021-24663

Simple School Staff Directory <= 1.1 - Admin+ Arbitrary File Upload

The Simple Schools Staff Directory WordPress plugin through 1.1 does not validate uploaded logo pictures to ensure that are indeed images, allowing high privilege users such as admin to upload arbitrary file like PHP, leading to RCE

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Simple Schools Staff Directory Project
Products
Simple Schools Staff Directory
CVE-2021-24620

Simple eCommerce <= 2.2.5 - Arbitrary File Upload

The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Simple-e-commerce-shopping-cart Project
Products
Simple-e-commerce-shopping-cart
CVE-2021-24499

Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution

The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. Uploaded files were neither sanitized nor validated, allowing an unauthenticated visitor to upload executable code such as php scripts.

CVSS 3.1 · 9.8 Critical EPSS 60.1% KEV · Not listed
Vendors
Amentotech
Products
Workreap
CVE-2021-24493

Shopp eCommerce <= 1.4 - Unauthenticated Arbitrary File Upload

The shopp_upload_file AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does not have any security measure in place to prevent upload of malicious files, such as PHP, allowing unauthenticated users to upload arbitrary files and leading to RCE

CVSS 3.1 · 9.8 Critical EPSS 2.0% KEV · Not listed
Vendors
Ingenesis
Products
Shopp
CVE-2021-24490

Email Artillery <= 4.1 - Arbitrary File Upload

The Email Artillery (MASS EMAIL) WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, allowing arbitrary files to be uploaded. Furthermore, the plugin is also lacking any CSRF check, allowing such issue to be exploited via a CSRF attack as well. However, due to the presence of a .htaccess, denying access to everything in the folder the file is uploaded to, the malicious uploaded file will only be accessible on Web Servers such as Nginx/IIS

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Email Artillery Project
Products
Email Artillery
CVE-2021-24376

Autoptimize < 2.7.8 - Arbitrary File Upload via "Import Settings"

The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Settings" feature, after its extraction. However, the extracted folders are not checked and it is possible to upload a zip which contained a directory with PHP file in it and then it is not removed from the disk. It is a bypass of CVE-2020-24948 which allows sending a PHP file via the "Import Settings" functionality to achieve Remote Code Execution.

CVSS 3.1 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Autoptimize
Products
Autoptimize
CVE-2021-24370

Fancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCE

The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 47.4% KEV · Not listed
Vendors
Radykal
Products
Fancy Product Designer
CVE-2021-24311

External Media < 1.0.34 - Authenticated Arbitrary File Upload

The wp_ajax_upload-remote-file AJAX action of the External Media WordPress plugin before 1.0.34 was vulnerable to arbitrary file uploads via any authenticated users.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed
Vendors
External Media Project
Products
External Media
CVE-2021-24284

Kaswara Modern VC Addons <= 3.0.1 - Unauthenticated Arbitrary File Upload

The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zipfile being unzipped in the wp-content/uploads/kaswara/fonts_icon directory with no checks for malicious files such as PHP.

CVSS 3.1 · 9.8 Critical EPSS 42.1% KEV · Not listed
Vendors
Kaswara Project
Products
Kaswara
CVE-2021-24254

College Publisher Import <= 0.1 - Arbitrary File Upload to RCE

The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. Due to the lack of CSRF check, the issue could also be exploited via a CSRF attack.

CVSS 3.1 · 7.2 High EPSS 1.8% KEV · Not listed
Vendors
College Publisher Import Project
Products
College Publisher Import
CVE-2021-24253

Classyfrieds <= 3.8 - Authenticated Arbitrary File Upload to RCE

The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Classyfrieds Project
Products
Classyfrieds
CVE-2021-24252

Event Banner <= 1.3 - Arbitrary File Upload to RCE

The Event Banner WordPress plugin through 1.3 does not verify the uploaded image file, allowing admin accounts to upload arbitrary files, such as .exe, .php, or others executable, leading to RCE. Due to the lack of CSRF check, the issue can also be used via such vector to achieve the same result, or via a LFI as authorisation checks are missing (but would require WP to be loaded)

CVSS 3.1 · 7.2 High EPSS 1.7% KEV · Not listed
Vendors
Wp-eventmanager
Products
Event Banner
CVE-2021-24248

Business Directory Plugin < 5.11.1 - Authenticated PHP4 Upload to RCE

The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 did not properly check for imported files, forbidding certain extension via a blacklist approach, allowing administrator to import an archive with a .php4 inside for example, leading to RCE

CVSS 3.1 · 7.2 High EPSS 1.6% KEV · Not listed
Vendors
Strategy11
Products
Business Directory Plugin - Easy Listing Directories
CVE-2021-24240

Business Hours Pro <= 5.5.0 - Unauthenticated Arbitrary File Upload to RCE

The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability.

CVSS 3.1 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Aivahthemes
Products
Business Hours Pro
CVE-2021-24236

Imagements <= 1.2.5 - Unauthenticated Arbitrary File Upload to RCE

The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the request to forbid dangerous files. This allows unauthenticated attackers to upload arbitrary files by using a valid image Content-Type along with a PHP filename and code, leading to RCE.

CVSS 3.1 · 9.8 Critical EPSS 7.3% KEV · Not listed
Vendors
Imagements Project
Products
Imagements