Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
12 results
Mar 26, 2026Ulloady is a file uploader script with multi-file upload support.CVE-2026-33653 · Other software · farisc0de · reported by GitHubMedium 4.6
Ulloady is a file uploader script with multi-file upload support. A Stored Cross-Site Scripting (XSS) vulnerability exists in versions prior to 3.1.2 due to improper sanitization of filenames during the file upload process. An attacker can upload a file with a malicious filename containing JavaScript code, which is later rendered in the application without proper escaping. When the filename is displayed in the file list or file details page, the malicious script executes in the browser of any user who views the page. Version 3.1.2 fixes the issue.
- Product
- Uploady
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026File Uploader for WooCommerce: Path Traversal: '.../...//'CVE-2026-25397 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in Snowray Software File Uploader for WooCommerce file-uploader-for-woocommerce allows Path Traversal.This issue affects File Uploader for WooCommerce: from n/a through <= 1.0.4.
- Product
- File Uploader for WooCommerce
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update File Uploader for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 19, 2025File Uploader for WooCommerce: Arbitrary file uploadsCVE-2025-13329 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The File Uploader for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the callback function for the 'add-image-data' REST API endpoint in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to upload arbitrary files to the Uploadcare service and subsequently download them on the affected site's server which may make remote code execution possible.
- Product
- File Uploader for WooCommerce
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update File Uploader for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Nov 6, 2025Drop Uploader for CF7 - Drag&Drop File Uploader Addon: Unrestricted Upload of File with Dangerous TypeCVE-2025-53283 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in borisolhor Drop Uploader for CF7 - Drag&Drop File Uploader Addon drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon allows Upload a Web Shell to a Web Server.This issue affects Drop Uploader for CF7 - Drag&Drop File Uploader Addon: from n/a through <= 2.4.1.
- Product
- Drop Uploader for CF7 - Drag&Drop File Uploader Addon
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Drop Uploader for CF7 - Drag&Drop File Uploader Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2024Uploadcare File Uploader and Adaptive Delivery (beta): Cross-Site Request Forgery (CSRF)CVE-2024-35636 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Uploadcare Uploadcare File Uploader and Adaptive Delivery (beta) uploadcare.This issue affects Uploadcare File Uploader and Adaptive Delivery (beta): from n/a through 3.0.11.
- Product
- Uploadcare File Uploader and Adaptive Delivery (beta)
- Affected
- up to 3.0.11
- What to do
- Affects up to 3.0.11. Update Uploadcare File Uploader and Adaptive Delivery (beta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 26, 2024MainWP File Uploader Extension: Unrestricted Upload of File with Dangerous TypeCVE-2023-23656 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in MainWP MainWP File Uploader Extension.This issue affects MainWP File Uploader Extension: from n/a through 4.1.
- Product
- MainWP File Uploader Extension
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update MainWP File Uploader Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 3, 2022Arbitrary file upload vulnerability in php uploaderCVE-2022-40721 · Other software · Creativedream File Uploader Project · reported by larry0@me.comCritical 9.8
Arbitrary file upload vulnerability in php uploader
- Product
- Creativedream File Uploader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comvapidlabs.com
May 11, 2022On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root CVE-2022-29898 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comCritical 9.1
On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware.
- Product
- RAD-ISM-900-EN-BD/B
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Jul 7, 2021A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users CVE-2021-34624 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .
- Product
- ProfilePress
- Affected
- 3.0.0 to 3.1.3
- What to do
- Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Sep 26, 2014Unrestricted file upload vulnerability in the N-Media file uploader plugin before 3.4 for WordPress allows remote authenticated users to execute arbitrary PHP cCVE-2014-5324 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Unrestricted file upload vulnerability in the N-Media file uploader plugin before 3.4 for WordPress allows remote authenticated users to execute arbitrary PHP code by leveraging Author privileges to store a file.
- Product
- Unrestricted file upload vulnerability in the N-Media file uploader
- Fixed in
- 3.4
- What to do
- Update Unrestricted file upload vulnerability in the N-Media file uploader to 3.4 or newer.
Jan 22, 2008Unrestricted file upload vulnerability in PHP F1 Max's File Uploader allows remote attackers to upload and execute arbitrary PHP files.CVE-2008-0373 · Websites & servers · PHP · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in PHP F1 Max's File Uploader allows remote attackers to upload and execute arbitrary PHP files.
- Product
- F1 Maxs File Uploader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Aug 13, 2007Multiple PHP remote file inclusion vulnerabilities in File Uploader 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the config[root_ordnerCVE-2007-4327 · Other software · Mapos Scripts · reported by MITREMedium 6.8
Multiple PHP remote file inclusion vulnerabilities in File Uploader 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter to (1) index.php or (2) datei.php.
- Product
- File Uploader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.