Login Request a demo
WF
Product
Wordpress File Upload
by Iptanus · last CVE Feb 25, 2025
25
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities25In the news0Timeline
Severity mix
Critical 4High 6Medium 14Low 1
Severity
All severities25Critical4High6Medium14Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Wordpress File Upload to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-11635
9.8
1%
Jan 8
WordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Execution
Affected: before 4.24.15
CVE-2024-11613
9.8
4%
Jan 8
WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion
Affected: before 4.25.0
CVE-2024-9047
9.8
93%
Oct 12
WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php
Affected: before 4.24.12
CVE-2020-10564
9.8
9%
Mar 13
An issue was discovered in the File Upload plugin before 4.13.0 for WordPress
Affected: before 4.13.0
CVE-2021-24962
8.8
3%
Mar 28
WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCE
Affected: before 4.16.3
CVE-2024-9939
7.5
1%
Jan 8
WordPress File Upload <= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php
Affected: before 4.24.14
CVE-2015-9340
7.5
1%
Aug 22
The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files
Affected: before 3.0.0
CVE-2015-9339
7.5
1%
Aug 22
The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files
Affected: before 2.7.1
CVE-2015-9338
7.5
1%
Aug 22
The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files
Affected: before 2.5.0
CVE-2015-9341
7.5
1%
Aug 22
The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files
Affected: before 3.4.1
CVE-2024-7301
6.1
0%
Aug 16
WordPress File Upload <= 4.24.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
Affected: before 4.24.9
CVE-2024-6494
6.1
0%
Aug 7
WordPress File Upload < 4.24.8 - Unauthenticated Stored XSS
Affected: before 4.24.8
CVE-2024-6651
6.1
16%
Aug 6
WordPress File Upload < 4.24.8 - Reflected XSS
Affected: before 4.24.8
CVE-2018-9844
6.1
4%
Apr 7
The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS
Affected: before 4.3.4
CVE-2023-2767
5.5
0%
Jun 9
WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Affected: through 4.19.1
CVE-2024-2847
5.4
0%
Apr 9
WordPress File Upload <= 4.24.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Affected: before 4.24.6
CVE-2023-4811
5.4
0%
Oct 16
WordPress File Upload < 4.23.3 - Author+ Stored Cross-Site Scripting
Affected: before 4.23.3
CVE-2021-24961
5.4
1%
Mar 7
WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Shortcode
Affected: before 4.16.3
CVE-2021-24960
5.4
1%
Mar 7
WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVG
Affected: before 4.16.3
CVE-2018-9172
5.4
3%
Apr 1
The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes
Affected: before 4.3.3
CVE-2023-2688
4.9
2%
Jun 9
WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Path Traversal
Affected: through 4.19.1
CVE-2024-13494
4.3
0%
Feb 25
WordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_details
Affected: before 4.25.3
CVE-2024-12719
4.3
0%
Jan 7
WordPress File Upload <= 4.24.15 - Missing Authorization to Authenticated (Subscriber+) Limited Path Traversal
Affected: before 4.25.0
CVE-2024-5852
4.3
1%
Jul 16
WordPress File Upload <= 4.24.7 - Authenticated (Contributor+) Directory Traversal
Affected: before 4.24.8
CVE-2024-39639
3.5
0%
Nov 1
WordPress File Upload plugin <= 4.24.7 - Broken Access Control + CSRF vulnerability
Affected: before 4.24.8
Showing 25