Arbitrary-File-Upload

WordPress WPAMS Plugin Arbitrary File Upload to RCE (CVE-2025-39401) newCVE-2025-39401webCRITICAL 10Unverified2026-07-06WavePlayer Unauthenticated Arbitrary File Upload to RCE (CVE-2025-12057) newCVE-2025-12057webCRITICAL 9.8Unverified2026-07-06StoryChief WordPress Plugin Unauthenticated Arbitrary File Upload via Webhook (CVE-2025-7441) new EPSS 39%CVE-2025-7441webCRITICAL 9.8Unpatched2026-07-06StoreKeeper for WooCommerce Unauthenticated Arbitrary File Upload (CVE-2025-48148) new EPSS 15%CVE-2025-48148webCRITICAL 9.8Unverified2026-07-06Samsung MagicINFO 9 Server Unauthenticated Path Traversal to RCE (CVE-2025-4632) new KEV EPSS 24%CVE-2025-4632webCRITICAL 9.8Patched2026-07-06KiotViet Sync Unauthenticated Arbitrary File Upload (CVE-2025-12674) newCVE-2025-12674webCRITICAL 9.8Unverified2026-07-06Flozen WordPress Theme Unauthenticated Arbitrary File Upload (CVE-2025-49071) newCVE-2025-49071webCRITICAL 9.8Unverified2026-07-06WPvivid Backup & Migration Unauthenticated Arbitrary File Upload RCE (CVE-2026-1357) new EPSS 33%CVE-2026-1357webCRITICALUnverified2026-07-05WebStack WordPress Theme Unauthenticated Arbitrary File Upload RCE — CVE-2026-1555 newCVE-2026-1555webCRITICAL 9.8Unverified2026-07-05Joomla Novarain Framework (nrframework) Unauthenticated Arbitrary File Inclusion — CVE-2026-21627 newCVE-2026-21627webCRITICAL 9.5Patched2026-07-05EventPrime WordPress Plugin Unauthenticated Arbitrary File Upload — CVE-2026-1657 newCVE-2026-1657webMEDIUMPatched2026-07-05