Iptanus Wordpress_file_upload
25 CVEs affecting Iptanus Wordpress_file_upload. Latest disclosed: 2025-02-25. Critical: 4, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11635 | Critical | 9.8 | 2025-01-08 | The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.12 via the 'wfu_ABSPATH' cooki… |
CVE-2024-11613 | Critical | 9.8 | 2025-01-08 | The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to… |
CVE-2024-9047 | Critical | 9.8 | 2024-10-12 | The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This… |
CVE-2020-10564 | Critical | 9.8 | 2020-03-13 | An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote code execution by uploading a crafted t… |
CVE-2021-24962 | High | 8.8 | 2022-03-28 | The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode… |
CVE-2024-9939 | High | 7.5 | 2025-01-08 | The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.13 via wfu_file_downloader.php. This… |
CVE-2015-9340 | High | 7.5 | 2019-08-22 | The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess… |
CVE-2015-9339 | High | 7.5 | 2019-08-22 | The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files. |
CVE-2015-9338 | High | 7.5 | 2019-08-22 | The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files. |
CVE-2015-9341 | High | 7.5 | 2019-08-22 | The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files. |
CVE-2024-7301 | High | 7.2 | 2024-08-16 | The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.24.8 d… |
CVE-2024-2847 | Medium | 6.4 | 2024-04-09 | The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including… |
CVE-2024-6494 | Medium | 6.1 | 2024-08-07 | The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthenticated users to e… |
CVE-2024-6651 | Medium | 6.1 | 2024-08-06 | The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2018-9844 | Medium | 6.1 | 2018-04-07 | The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS. |
CVE-2023-4811 | Medium | 5.4 | 2023-10-16 | The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could allow high privilege users such as cont… |
CVE-2021-24961 | Medium | 5.4 | 2022-03-07 | The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 does not escape some of its shortcode argume… |
CVE-2021-24960 | Medium | 5.4 | 2022-03-07 | The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contribut… |
CVE-2018-9172 | Medium | 5.4 | 2018-04-01 | The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes. |
CVE-2023-2688 | Medium | 4.9 | 2023-06-09 | The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versions up to, and including, 4.19.1 via the… |