https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 18:36:05 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-284371 EUVD-2026-284371 https://cve.radiocsirt.org/vuln/euvd-2026-284371 https://cve.radiocsirt.org/vuln/fkie_cve-2023-6187 <p>The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the &#39;pmpro_paypalexpress_session_vars_for_user_fields&#39; function in versions up to, and including, 2.12.3. This makes it possible for authenticated attackers with subscriber privileges or above, to upload arbitrary files on the affected site&#39;s server which may make remote code execution possible. This can be exploited if 2Checkout (deprecated since version 2.6) or PayPal Express is set as the payment method and a custom user field is added that is only visible at profile, and not visible at checkout according to its settings.</p> <p>The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the &#39;pmpro_paypalexpress_session_vars_for_user_fields&#39; function in versions up to, and including, 2.12.3. This makes it possible for authenticated attackers with subscriber privileges or above, to upload arbitrary files on the affected site&#39;s server which may make remote code execution possible. This can be exploited if 2Checkout (deprecated since version 2.6) or PayPal Express is set as the payment method and a custom user field is added that is only visible at profile, and not visible at checkout according to its settings.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-6187 https://cve.radiocsirt.org/vuln/ghsa-wwhh-cm65-x8qq <p>The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads to insufficient file type validation in the &#39;pmpro_paypalexpress_session_vars_for_user_fields&#39; function in versions up to, and including, 2.12.3. This makes it possible for authenticated attackers with subscriber privileges or above, to upload arbitrary files on the affected site&#39;s server which may make remote code execution possible. This can be exploited if 2Checkout (deprecated since version 2.6) or PayPal Express is set as the payment method and a custom user field is added that is only visible at profile, and not visible at checkout according to its settings.</p> <p>The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads to insufficient file type validation in the &#39;pmpro_paypalexpress_session_vars_for_user_fields&#39; function in versions up to, and including, 2.12.3. This makes it possible for authenticated attackers with subscriber privileges or above, to upload arbitrary files on the affected site&#39;s server which may make remote code execution possible. This can be exploited if 2Checkout (deprecated since version 2.6) or PayPal Express is set as the payment method and a custom user field is added that is only visible at profile, and not visible at checkout according to its settings.</p> https://cve.radiocsirt.org/vuln/ghsa-wwhh-cm65-x8qq https://cve.radiocsirt.org/vuln/gsd-2023-6187 gsd-2023-6187 https://cve.radiocsirt.org/vuln/gsd-2023-6187