CVE-2024-13448

ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data

The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'trx_addons_uploads_save_data' function in all versions up to, and including, 2.32.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Themerex

Products

Addons

CVE-2024-7855

WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload

The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_review() function in all versions up to, and including, 2.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 8.8 High EPSS 17.7% KEV · Not listed

Vendors

Thimpress

Products

Wp Hotel Booking

CVE-2024-8614

WP JobSearch <= 2.6.7 - Authenticated (Subscriber+) Arbitrary File Upload

The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_wp_handle_upload() function in all versions up to, and including, 2.6.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Eyecix

Products

Jobsearch Wp Job Board

CVE-2024-7620

Customizer Export/Import <= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import

The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: This vulnerability is only exploitable when used in conjunction with a race condition as the uploaded file is deleted shortly after it is created.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Fastlinemedia The Beaver Builder Team

Products

Customizer Export\/import Cutomizer Export\/import

CVE-2024-13882

Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.3.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Upload

The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aiomatic_generate_featured_image' function in all versions up to, and including, 2.3.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Coderevolution

Products

Aiomatic

CVE-2015-10144

Responsive Thumbnail Slider < 1.0.1 - Authenticated (Subscriber+) Arbitrary File Upload

The Responsive Thumbnail Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type sanitization in the via the image uploader in versions up to 1.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected sites server using a double extension which may make remote code execution possible.

CVSS 3.1 · 8.8 High EPSS 3.6% KEV · Not listed

Vendors

I13websolution Wordpress

Products

Thumbnail Carousel Slider Wordpress

CVE-2025-6220

Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_options' function in all versions up to, and including, 3.5.12. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 7.2 High EPSS 1.2% KEV · Not listed

Vendors

Themefic

Products

Ultimate Addons For Contact Form 7

CVE-2023-0714

Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in versions up to, and including, 3.2.4. This allows unauthenticated visitors to perform a "double extension" attack and upload files containing a malicious extension but ending with a benign extension, which may make remote code execution possible in some configurations.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Wpmet

Products

Metform Elementor Contact Form Builder

CVE-2024-7772

Jupiter X Core <= 4.6.5 - Unauthenticated Arbitrary File Upload

The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' function in all versions up to, and including, 4.6.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed

Vendors

Artbees

Products

Jupiter X Core

CVE-2024-13342

Booster for WooCommerce <= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload

The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_files_to_order' function in all versions up to, and including, 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files with double extensions on the affected site's server which may make remote code execution possible. This is only exploitable on select instances where the configuration will execute the first extension present.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Booster

Products

Booster For Woocommerce

CVE-2016-15043

WP Mobile Detector <= 3.5 - Arbitrary File Upload

The WP Mobile Detector plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in resize.php file in versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

CVSS 3.1 · 9.8 Critical EPSS 8.9% KEV · Not listed

Vendors

Wordpress Wp Mobile Detector Project

Products

Wordpress Wp Mobile Detector

CVE-2024-10584

DirectoryPress <= 3.6.16 - Authenticated (Author+) Stored Cross-Site Scripting

The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.6.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. When DirectoryPress Frontend is installed, this can be exploited by unauthenticated users.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Designinvento Wordpress

Products

Directorypress Wordpress

CVE-2015-10135

WPshop 2 – E-Commerce < 1.3.9.6 - Arbitrary File Upload

The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxUpload function in versions before 1.3.9.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

CVSS 3.1 · 9.8 Critical EPSS 4.6% KEV · Not listed

Vendors

Eoxia Wordpress

Products

Wpshop 2 Wordpress

CVE-2024-10960

Brizy – Page Builder <= 2.6.4 - Authenticated (Contributor+) Arbitrary File Upload via storeUploads

The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'storeUploads' function in all versions up to, and including, 2.6.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Brizy

Products

Brizy

CVE-2016-15042

Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload

The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

CVSS 3.1 · 9.8 Critical EPSS 6.7% KEV · Not listed

Vendors

Najeebmedia

Products

Frontend File Manager N-media Post Front-end Form Post Front-end Form

CVE-2024-8066

File Manager Pro – Filester <= 1.8.6- Authenticated (Subscriber+) Arbitrary File Upload

The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing validation in the 'fsConnector' function in all versions up to, and including, 1.8.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to upload a new .htaccess file allowing them to subsequently upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Ninjateam

Products

Filemanager Pro-filester Filester

CVE-2024-6756

Social Auto Poster <= 5.3.14 - Authenticated (Contributor+) Arbitrary File Upload

The Social Auto Poster plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpw_auto_poster_get_image_path' function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. An attacker can use CVE-2024-6754 to exploit with subscriber-level access.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wpweb Wpwebinfotech

Products

Social Auto Poster Social Auto Poster

CVE-2024-9660

School Management <= 91.5.0 - Authenticated (Student+) Arbitrary File Upload

The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mj_smgt_load_documets_new() and mj_smgt_load_documets() functions in all versions up to, and including, 91.5.0. This makes it possible for authenticated attackers, with Student-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed

Vendors

Dasinfomedia

Products

School Management System

CVE-2024-10627

WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Upload

The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_chunk_upload() function in all versions up to, and including, 17.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Support Ticket System Project Vanquish

Products

Support Ticket System Woocommerce Support Ticket System

CVE-2024-5226

Fuse Social Floating Sidebar <= 5.4.10 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload

The Fuse Social Floating Sidebar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the file upload functionality in all versions up to, and including, 5.4.10 due to insufficient validation of SVG files. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Daniyalahmedk

Products

Fuse Social Floating Sidebar