https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 06:38:08 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-335934 EUVD-2026-335934 https://cve.radiocsirt.org/vuln/euvd-2026-335934 https://cve.radiocsirt.org/vuln/fkie_cve-2026-2354 <p>The Swiss Toolkit For WP plugin for WordPress is vulnerable to arbitrary file upload due to a flawed file type validation bypass in the `upload_extension_files()` function in all versions up to, and including, 1.4.6. The `upload_extension_files()` function hooks into WordPress&#39;s `wp_check_filetype_and_ext` filter and uses `strpos()` to check if a filename contains a configured extension string, rather than verifying the actual file extension. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files (including PHP) on the affected site&#39;s server which may make remote code execution possible, granted the &#34;Enhanced Multi-Format Image Support&#34; feature is enabled with at least one extension (e.g., avif) in the allowed formats.</p> <p>The Swiss Toolkit For WP plugin for WordPress is vulnerable to arbitrary file upload due to a flawed file type validation bypass in the `upload_extension_files()` function in all versions up to, and including, 1.4.6. The `upload_extension_files()` function hooks into WordPress&#39;s `wp_check_filetype_and_ext` filter and uses `strpos()` to check if a filename contains a configured extension string, rather than verifying the actual file extension. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files (including PHP) on the affected site&#39;s server which may make remote code execution possible, granted the &#34;Enhanced Multi-Format Image Support&#34; feature is enabled with at least one extension (e.g., avif) in the allowed formats.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-2354 https://cve.radiocsirt.org/vuln/ghsa-xq2v-8qf4-3rg6 <p>The Swiss Toolkit For WP plugin for WordPress is vulnerable to arbitrary file upload due to a flawed file type validation bypass in the `upload_extension_files()` function in all versions up to, and including, 1.4.6. The `upload_extension_files()` function hooks into WordPress&#39;s `wp_check_filetype_and_ext` filter and uses `strpos()` to check if a filename contains a configured extension string, rather than verifying the actual file extension. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files (including PHP) on the affected site&#39;s server which may make remote code execution possible, granted the &#34;Enhanced Multi-Format Image Support&#34; feature is enabled with at least one extension (e.g., avif) in the allowed formats.</p> <p>The Swiss Toolkit For WP plugin for WordPress is vulnerable to arbitrary file upload due to a flawed file type validation bypass in the `upload_extension_files()` function in all versions up to, and including, 1.4.6. The `upload_extension_files()` function hooks into WordPress&#39;s `wp_check_filetype_and_ext` filter and uses `strpos()` to check if a filename contains a configured extension string, rather than verifying the actual file extension. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files (including PHP) on the affected site&#39;s server which may make remote code execution possible, granted the &#34;Enhanced Multi-Format Image Support&#34; feature is enabled with at least one extension (e.g., avif) in the allowed formats.</p> https://cve.radiocsirt.org/vuln/ghsa-xq2v-8qf4-3rg6