https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T15:59:22.561252+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-288389 EUVD-2026-288389 2026-10-06T15:59:22.563428+00:00 EUVD-2026-288389 https://cve.radiocsirt.org/vuln/fkie_cve-2024-8725 fkie_cve-2024-8725 2026-10-06T15:59:22.563460+00:00

Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions. This is due to a lack of proper checks to ensure lower-privileged roles cannot upload .css and .js files to arbitrary directories. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files to any directory within the WordPress root directory, which could lead to Stored Cross-Site Scripting. The Advanced File Manager Shortcodes plugin must be installed to exploit this vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-gqqx-m28r-fmjj GHSA-gqqx-m28r-fmjj 2026-10-06T15:59:22.563492+00:00

Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions. This is due to a lack of proper checks to ensure lower-privileged roles cannot upload .css and .js files to arbitrary directories. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files to any directory within the WordPress root directory, which could lead to Stored Cross-Site Scripting. The Advanced File Manager Shortcodes plugin must be installed to exploit this vulnerability.