Vulnerabilities > Unrestricted Upload of File with Dangerous Type

DATE	CVE	VULNERABILITY TITLE	RISK
2025-01-22	CVE-2024-13091	The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'qcld_wpcfb_file_upload' function in all versions up to, and including, 13.5.4. network low complexity CWE-434 critical	9.8
2025-01-20	CVE-2025-0582	A vulnerability classified as critical was found in itsourcecode Farm Management System up to 1.0. network low complexity CWE-434	4.7
2025-01-17	CVE-2024-13333	The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fma_local_file_system' function in versions 5.2.12 to 5.2.13. network high complexity CWE-434	7.5
2025-01-16	CVE-2024-13355	The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to limited file uploads due to insufficient file type validation in the upload_file() function in all versions up to, and including, 13.2. network low complexity CWE-434	5.4
2025-01-14	CVE-2025-0394	The WordPress CRM, Email & Marketing Automation for WordPress \| Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gh_big_file_upload() function in all versions up to, and including, 3.7.3.5. network low complexity CWE-434	8.8
2025-01-08	CVE-2024-12853	The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 2.11.10. network low complexity CWE-434	8.8
2025-01-08	CVE-2024-12854	The Garden Gnome Package plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the functionality that automatically extracts 'ggpkg' files that have been uploaded in all versions up to, and including, 2.3.0. network low complexity CWE-434	8.8
2025-01-05	CVE-2024-13138	Unrestricted Upload of File with Dangerous Type vulnerability in Wangl1989 Mysiteforme 1.0 A vulnerability was found in wangl1989 mysiteforme 1.0. network low complexity wangl1989 CWE-434	8.8
2025-01-04	CVE-2025-0213	Unrestricted Upload of File with Dangerous Type vulnerability in Campcodes Project Management System 1.0 A vulnerability was found in Campcodes Project Management System 1.0. network low complexity campcodes CWE-434 critical	9.8
2024-12-24	CVE-2024-10584	The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.6.16 due to insufficient input sanitization and output escaping. network low complexity CWE-434	5.4