Filtered by CWE-434
Filtered by vendor Subscriptions
Total 3886 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-2249 1 Wordpress 1 Wordpress 2025-07-13 8.8 High
The SoJ SoundSlides plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the soj_soundslides_options_subpanel() function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVE-2025-32140 1 Wordpress 1 Wordpress 2025-07-13 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Nirmal Kumar Ram WP Remote Thumbnail allows Upload a Web Shell to a Web Server. This issue affects WP Remote Thumbnail: from n/a through 1.3.1.
CVE-2023-49815 1 Wordpress 1 Wordpress 2025-07-13 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in WappPress Team WappPress.This issue affects WappPress: from n/a through 5.0.3.
CVE-2024-33556 1 8theme 1 Xstore Core 2025-07-13 8.2 High
Unrestricted Upload of File with Dangerous Type vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.8.
CVE-2025-39436 1 Wordpress 1 Wordpress 2025-07-13 9.1 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in aidraw I Draw allows Using Malicious Files. This issue affects I Draw: from n/a through 1.0.
CVE-2024-31114 1 Wordpress 1 Wordpress 2025-07-13 9.1 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in biplob018 Shortcode Addons.This issue affects Shortcode Addons: from n/a through 3.2.5.
CVE-2025-3917 1 Wordpress 1 Wordpress 2025-07-13 9.8 Critical
The 百度站长SEO合集(支持百度/神马/Bing/头条推送) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the download_remote_image_to_media_library function in all versions up to, and including, 2.0.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVE-2023-27440 1 Wordpress 1 Wordpress 2025-07-13 7.2 High
Unrestricted Upload of File with Dangerous Type vulnerability in OnTheGoSystems Types.This issue affects Types: from n/a through 3.4.17.
CVE-2024-10590 1 Wordpress 1 Wordpress 2025-07-13 8.8 High
The Opt-In Downloads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the admin_upload() function in all versions up to, and including, 4.07. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Due to the presence of an .htaccess file, this can only be exploited to achieve RCE on NGINX servers, unless another vulnerability is present.
CVE-2024-32954 2 Tribulant, Wordpress 2 Newsletters, Wordpress 2025-07-13 9.1 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Tribulant Newsletters.This issue affects Newsletters: from n/a through 4.9.5.
CVE-2025-28915 1 Wordpress 1 Wordpress 2025-07-13 9.1 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Theme Egg ThemeEgg ToolKit allows Upload a Web Shell to a Web Server. This issue affects ThemeEgg ToolKit: from n/a through 1.2.9.
CVE-2024-38736 1 Wordpress 1 Wordpress 2025-07-13 9.1 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Realtyna Realtyna Organic IDX plugin allows Code Injection.This issue affects Realtyna Organic IDX plugin: from n/a through 4.14.13.
CVE-2024-9698 1 Wordpress 1 Wordpress 2025-07-13 7.2 High
The Crafthemes Demo Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'process_uploaded_files' function in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVE-2025-32579 1 Wordpress 1 Wordpress 2025-07-13 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in SoftClever Limited Sync Posts allows Upload a Web Shell to a Web Server. This issue affects Sync Posts: from n/a through 1.0.
CVE-2024-51919 1 Wordpress 1 Wordpress 2025-07-13 9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in NotFound Fancy Product Designer. This issue affects Fancy Product Designer: from n/a through 6.4.3.
CVE-2024-6828 2 Redux, Wordpress 2 Gutenberg Template Library \& Redux Framework, Wordpress 2025-07-13 7.2 High
The Redux Framework plugin for WordPress is vulnerable to unauthenticated JSON file uploads due to missing authorization and capability checks on the Redux_Color_Scheme_Import function in versions 4.4.12 to 4.4.17. This makes it possible for unauthenticated attackers to upload JSON files, which can be used to conduct stored cross-site scripting attacks and, in some rare cases, when the wp_filesystem fails to initialize - to Remote Code Execution.
CVE-2024-43243 1 Wordpress 1 Wordpress 2025-07-13 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGlow JobBoard Job listing allows Upload a Web Shell to a Web Server.This issue affects JobBoard Job listing: from n/a through 1.2.6.
CVE-2024-56064 1 Wordpress 1 Wordpress 2025-07-13 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Azzaroco WP SuperBackup allows Upload a Web Shell to a Web Server.This issue affects WP SuperBackup: from n/a through 2.3.3.
CVE-2024-56249 1 Wordpress 1 Wordpress 2025-07-13 9.1 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Webdeclic WPMasterToolKit allows Upload a Web Shell to a Web Server.This issue affects WPMasterToolKit: from n/a through 1.13.1.
CVE-2024-30231 2 Webtoffee, Wordpress 2 Product Import Export For Woocommerce, Wordpress 2025-07-13 9.1 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This issue affects Product Import Export for WooCommerce: from n/a through 2.4.1.