Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,871

Export CSV
CVE-2021-24663

Simple School Staff Directory <= 1.1 - Admin+ Arbitrary File Upload

The Simple Schools Staff Directory WordPress plugin through 1.1 does not validate uploaded logo pictures to ensure that are indeed images, allowing high privilege users such as admin to upload arbitrary file like PHP, leading to RCE

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Simple Schools Staff Directory Project
Products
Simple Schools Staff Directory
CVE-2021-24620

Simple eCommerce <= 2.2.5 - Arbitrary File Upload

The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Simple-e-commerce-shopping-cart Project
Products
Simple-e-commerce-shopping-cart
CVE-2021-24499

Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution

The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. Uploaded files were neither sanitized nor validated, allowing an unauthenticated visitor to upload executable code such as php scripts.

CVSS 3.1 · 9.8 Critical EPSS 60.1% KEV · Not listed
Vendors
Amentotech
Products
Workreap
CVE-2021-24493

Shopp eCommerce <= 1.4 - Unauthenticated Arbitrary File Upload

The shopp_upload_file AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does not have any security measure in place to prevent upload of malicious files, such as PHP, allowing unauthenticated users to upload arbitrary files and leading to RCE

CVSS 3.1 · 9.8 Critical EPSS 2.0% KEV · Not listed
Vendors
Ingenesis
Products
Shopp
CVE-2021-24490

Email Artillery <= 4.1 - Arbitrary File Upload

The Email Artillery (MASS EMAIL) WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, allowing arbitrary files to be uploaded. Furthermore, the plugin is also lacking any CSRF check, allowing such issue to be exploited via a CSRF attack as well. However, due to the presence of a .htaccess, denying access to everything in the folder the file is uploaded to, the malicious uploaded file will only be accessible on Web Servers such as Nginx/IIS

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Email Artillery Project
Products
Email Artillery
CVE-2021-24376

Autoptimize < 2.7.8 - Arbitrary File Upload via "Import Settings"

The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Settings" feature, after its extraction. However, the extracted folders are not checked and it is possible to upload a zip which contained a directory with PHP file in it and then it is not removed from the disk. It is a bypass of CVE-2020-24948 which allows sending a PHP file via the "Import Settings" functionality to achieve Remote Code Execution.

CVSS 3.1 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Autoptimize
Products
Autoptimize
CVE-2021-24370

Fancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCE

The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 47.4% KEV · Not listed
Vendors
Radykal
Products
Fancy Product Designer
CVE-2021-24311

External Media < 1.0.34 - Authenticated Arbitrary File Upload

The wp_ajax_upload-remote-file AJAX action of the External Media WordPress plugin before 1.0.34 was vulnerable to arbitrary file uploads via any authenticated users.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed
Vendors
External Media Project
Products
External Media
CVE-2021-24284

Kaswara Modern VC Addons <= 3.0.1 - Unauthenticated Arbitrary File Upload

The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zipfile being unzipped in the wp-content/uploads/kaswara/fonts_icon directory with no checks for malicious files such as PHP.

CVSS 3.1 · 9.8 Critical EPSS 42.1% KEV · Not listed
Vendors
Kaswara Project
Products
Kaswara
CVE-2021-24254

College Publisher Import <= 0.1 - Arbitrary File Upload to RCE

The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. Due to the lack of CSRF check, the issue could also be exploited via a CSRF attack.

CVSS 3.1 · 7.2 High EPSS 1.8% KEV · Not listed
Vendors
College Publisher Import Project
Products
College Publisher Import
CVE-2021-24253

Classyfrieds <= 3.8 - Authenticated Arbitrary File Upload to RCE

The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Classyfrieds Project
Products
Classyfrieds
CVE-2021-24252

Event Banner <= 1.3 - Arbitrary File Upload to RCE

The Event Banner WordPress plugin through 1.3 does not verify the uploaded image file, allowing admin accounts to upload arbitrary files, such as .exe, .php, or others executable, leading to RCE. Due to the lack of CSRF check, the issue can also be used via such vector to achieve the same result, or via a LFI as authorisation checks are missing (but would require WP to be loaded)

CVSS 3.1 · 7.2 High EPSS 1.7% KEV · Not listed
Vendors
Wp-eventmanager
Products
Event Banner
CVE-2021-24248

Business Directory Plugin < 5.11.1 - Authenticated PHP4 Upload to RCE

The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 did not properly check for imported files, forbidding certain extension via a blacklist approach, allowing administrator to import an archive with a .php4 inside for example, leading to RCE

CVSS 3.1 · 7.2 High EPSS 1.6% KEV · Not listed
Vendors
Strategy11
Products
Business Directory Plugin - Easy Listing Directories
CVE-2021-24240

Business Hours Pro <= 5.5.0 - Unauthenticated Arbitrary File Upload to RCE

The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability.

CVSS 3.1 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Aivahthemes
Products
Business Hours Pro
CVE-2021-24236

Imagements <= 1.2.5 - Unauthenticated Arbitrary File Upload to RCE

The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the request to forbid dangerous files. This allows unauthenticated attackers to upload arbitrary files by using a valid image Content-Type along with a PHP filename and code, leading to RCE.

CVSS 3.1 · 9.8 Critical EPSS 7.3% KEV · Not listed
Vendors
Imagements Project
Products
Imagements
CVE-2021-24224

Easy Form Builder <= 1.0 - Authenticated Arbitrary File Upload

The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Easy-form-builder-by-bitware Project
Products
Easy-form-builder-by-bitware
CVE-2021-24223

N5 Upload Form <= 1.0 - Unauthenticated Arbitrary File Upload to RCE

The N5 Upload Form WordPress plugin through 1.0 suffers from an arbitrary file upload issue in page where a Form from the plugin is embed, as any file can be uploaded. The uploaded filename might be hard to guess as it's generated with md5(uniqid(rand())), however, in the case of misconfigured servers with Directory listing enabled, accessing it is trivial.

CVSS 3.1 · 9.8 Critical EPSS 2.2% KEV · Not listed
Vendors
N5 Upload Form Project
Products
N5 Upload Form
CVE-2021-24222

WP-Curricul Vitea Free <= 6.3 - Unauthenticated Arbitrary File Upload to RCE

The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the [formCadastro] is embed. The form allows unauthenticated user to register and submit files for their profile picture as well as resume, without any file extension restriction, leading to RCE.

CVSS 3.1 · 9.8 Critical EPSS 2.4% KEV · Not listed
Vendors
Williamluis
Products
Wp-curriculo Vitae Free
CVE-2021-24220

All Thrive Themes Legacy Themes < 2.0.0 - Unauthenticated Arbitrary File Upload and Option Deletion

Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code.

CVSS 3.1 · 9.1 Critical EPSS 3.9% KEV · Not listed
Vendors
Thrivethemes
Products
Focusblog Ignition Luxe and 7 more
CVE-2021-24216

All-in-One WP Migration < 7.41 - Admin+ Arbitrary File Upload to RCE

The All-in-One WP Migration WordPress plugin before 7.41 does not validate uploaded files' extension, which allows administrators to upload PHP files on their site, even on multisite installations.

CVSS 3.1 · 7.2 High EPSS 1.7% KEV · Not listed
Vendors
Servmask
Products
One-stop Wp Migration