https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T06:41:50.416141+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-335409 EUVD-2026-335409 2026-10-08T06:41:50.464028+00:00 EUVD-2026-335409 https://cve.radiocsirt.org/vuln/fkie_cve-2026-10834 fkie_cve-2026-10834 2026-10-08T06:41:50.464067+00:00

The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.

 https://cve.radiocsirt.org/vuln/ghsa-qj2j-73pj-4fxf GHSA-qj2j-73pj-4fxf 2026-10-08T06:41:50.464103+00:00

The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.