Arbitrary file upload in WordPress plugins

Arbitrary file upload means the plugin lets someone upload a file without checking what kind of file it is. If an attacker can upload a .php file into a folder the web server runs, they can then open it in a browser and run their own code.

This is one of the most common ways WordPress sites get backdoored. The uploaded file is often named to look harmless and placed in wp-content/uploads.

What to do: update immediately. If you ran a vulnerable version, look for .php files inside wp-content/uploads (there should normally be none) and run a free scan. Many hosts let you block PHP from running in the uploads folder; ask yours.

Worried a plugin bug was used on your site?

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Newest Arbitrary file upload records

364 on record for the plugins we track; the newest 100 are below. Data as of 2026-11-04.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

critical 9.8 SimpleForm

Arbitrary file upload

CVE-2026-118235 · affected 3.10.2 and older · fixed in 3.11.0 * · published 2026-10-31
high 7.5 Photo Gallery, Sliders, Proofing and Themes

Arbitrary file upload

CVE-2026-76012 · affected 4.4.1 and older · fixed in 4.5.0 * · published 2026-10-30
critical 9.8 Contact Manager

Arbitrary file upload

CVE-2026-109218 · affected 9.1.2 and older · fixed in 9.1.3 * · published 2026-10-28
high 8.8 The Innovative Form Builder

Arbitrary file upload

CVE-2026-109384 · affected 1.5.1 and older · fixed in 1.5.2 * · published 2026-10-28
high 7.5 affiliate-toolkit

Arbitrary file upload

CVE-2026-111255 · affected 3.9.2 and older · fixed in 3.9.3 * · published 2026-10-28
medium 5.4 Depicter

Arbitrary file upload

CVE-2026-113472 · affected 4.0.5 up to (not including) 4.8.2 · fixed in 4.8.2 · published 2026-10-23
critical 9.9 Mang Board

Arbitrary file upload

CVE-2026-111834 · affected 2.4.4 and older · fixed in 2.4.5 · published 2026-10-21
critical 10.0 WP Mailster

Arbitrary file upload

CVE-2026-111832 · affected 1.9.1.0 and older · fixed in 1.9.2.0 · published 2026-10-21
critical 9.9 MapSVG

Arbitrary file upload

CVE-2026-111406 · affected 8.16.1 and older · fixed in 8.16.2 · published 2026-10-19
high 8.8 DoubleScale CRM

Arbitrary file upload

CVE-2026-111311 · affected 1.5.1 and older · fixed in 1.6.0 * · published 2026-10-16
high 8.8 YaySMTP

Arbitrary file upload

CVE-2026-92553 · affected 2.7.7 and older · fixed in 2.7.8 * · published 2026-10-16
critical 9.8 ELEX WordPress HelpDesk & Customer Ticketing S…

Arbitrary file upload

CVE-2026-103768 · affected 3.3.7 and older · fixed in 3.3.8 * · published 2026-10-16
critical 9.8 Mang Board

Arbitrary file upload

CVE-2026-109219 · affected 2.4.4 only · fixed in 2.4.5 * · published 2026-10-16
critical 9.8 10Web Booster

Arbitrary file upload

CVE-2026-108587 · affected 2.34.10 and older · fixed in 2.34.11 * · published 2026-10-15
high 8.8 FV Flowplayer Video Player

Arbitrary file upload

CVE-2026-86461 · affected 7.5.54.7212 and older · fix not stated · published 2026-10-14
critical 9.8 JTL-Connector for WooCommerce

Arbitrary file upload

CVE-2026-87855 · affected 2.4.3 and older · fix not stated · published 2026-10-14
critical 9.8 Snazzy Social Media Feed

Arbitrary file upload

CVE-2026-110002 · affected 2.5 and older · fix not stated · published 2026-10-14
critical 9.8 Printcart Store

Arbitrary file upload

CVE-2026-93388 · affected 2.9.1 and older · fixed in 2.9.2 * · published 2026-10-14
medium 5.3 WP-BusinessDirectory

Arbitrary file upload

CVE-2026-89271 · affected 4.0.2 and older · fix not stated · published 2026-10-13
critical 9.9 Creator LMS

Arbitrary file upload

CVE-2026-62129 · affected 1.2.21 and older · fixed in 1.2.22 · published 2026-10-10
critical 9.9 affects latest 1.1.2 CodeBard Help Desk

Arbitrary file upload

CVE-2026-62024 · affected 1.1.2 and older · no fix listed yet · published 2026-10-10
critical 9.0 Tailored Tools

Arbitrary file upload

CVE-2026-62025 · affected 3.0.3 and older · fixed in 3.0.5 * · published 2026-10-10
medium 5.3 WP CV Builder

Arbitrary file upload

CVE-2026-3717 · affected 1.3.1 and older · fixed in 1.3.2 * · published 2026-10-10
high 8.8 FV Player 8

Arbitrary file upload

CVE-2026-83526 · affected 8.1.7 and older · fix not stated · published 2026-10-10
critical 9.8 Extensions For CF7 (Contact form 7 Database, C…

Arbitrary file upload

CVE-2026-94589 · affected 3.4.5 and older · fixed in 3.4.6 * · published 2026-10-10
critical 9.9 affects latest 1.1.11 WP Duplicate

Arbitrary file upload

CVE-2026-39755 · affected 1.1.11 and older · no fix listed yet · published 2026-10-06
critical 10.0 Kognetiks Chatbot

Arbitrary file upload

CVE-2026-32579 · affected 2.4.9 and older · fixed in 2.5.0 * · published 2026-10-06
critical 9.8 Ultra Addons for Contact Form 7

Arbitrary file upload

CVE-2026-82901 · affected 3.5.50 and older · fixed in 3.5.51 * · published 2026-09-26
critical 9.8 Multi Uploader for Gravity Forms

Arbitrary file upload

CVE-2026-87796 · affected 1.1.9 and older · fixed in 1.1.10 * · published 2026-09-17
high 8.1 Paid Downloads

Arbitrary file upload

CVE-2026-87935 · affected 3.15 and older · fix not stated · published 2026-09-17
critical 9.8 MIPL Checkout Fields Manager for WooCommerce

Arbitrary file upload

CVE-2026-8778 · affected 1.2.2 and older · fixed in 1.2.3 * · published 2026-09-11
critical 9.8 Drag and Drop File Upload for Elementor Forms

Arbitrary file upload

CVE-2026-18351 · affected 1.6.0 and older · fixed in 1.6.1 * · published 2026-09-10
high 7.2 Master Addons for Elementor

Arbitrary file upload

CVE-2026-75921 · affected 3.1.9 and older · fixed in 3.2.0 * · published 2026-09-01
critical 9.8 WPLP Cookie Consent

Arbitrary file upload

CVE-2026-75865 · affected 4.4.1 and older · fixed in 4.4.2 * · published 2026-09-01
critical 10.0 Hash Form

Arbitrary file upload

CVE-2026-81780 · affected 1.4.2 and older · fixed in 1.4.3 · published 2026-08-31
critical 10.0 WPLP Cookie Consent

Arbitrary file upload

CVE-2026-82970 · affected 4.4.1 and older · fixed in 4.4.2 · published 2026-08-31
medium 5.3 Breeze Cache

Arbitrary file upload

CVE-2026-79706 · affected older than 2.5.13 · fixed in 2.5.13 · published 2026-08-28
high 8.8 CM Map Locations

Arbitrary file upload

CVE-2026-16601 · affected 2.1.8 and older · fixed in 2.1.9 * · published 2026-08-25
critical 9.1 Media Library Assistant

Arbitrary file upload

CVE-2026-66600 · affected 3.39 and older · fixed in 3.40 · published 2026-08-20
critical 9.8 Masteriyo LMS

Arbitrary file upload

CVE-2026-73996 · affected 2.3.2 and older · fixed in 2.3.3 · published 2026-08-18
critical 9.9 Templatiq

Arbitrary file upload

CVE-2026-32474 · affected 0.2.5 and older · fix not stated · published 2026-08-18
critical 9.9 affects latest 1.9.3 Sync Post With Other Site

Arbitrary file upload

CVE-2026-32463 · affected 1.9.3 and older · no fix listed yet · published 2026-08-18
critical 9.8 Forminator Forms

Arbitrary file upload

CVE-2026-15748 · affected 1.56.1 and older · fixed in 1.56.2 * · published 2026-08-18
critical 9.8 ProSolution WP Client

Arbitrary file upload

CVE-2026-16098 · affected 2.0.10 and older · fixed in 2.0.18 * · published 2026-08-16
high 8.8 MaxUpload

Arbitrary file upload

CVE-2026-15965 · affected 1.4.0 and older · fix not stated · published 2026-08-15
high 8.8 LightSync Pro

Arbitrary file upload

CVE-2026-6147 · affected 2.1.6 and older · fixed in 2.1.7 * · published 2026-08-05
high 8.8 Realtyna Organic IDX plugin + WPL Real Estate

Arbitrary file upload

CVE-2026-16236 · affected 5.3.0 and older · fixed in 5.4.0 * · published 2026-07-31
critical 9.8 Realtyna Organic IDX plugin + WPL Real Estate

Arbitrary file upload

CVE-2026-14483 · affected 5.2.0 and older · fixed in 5.3.0 * · published 2026-07-31
high 7.2 Easy Digital Downloads

Arbitrary file upload

CVE-2026-12476 · affected 3.6.9 and older · fixed in 3.6.9.1 * · published 2026-07-29
critical 9.1 Really Simple CSV Importer

Arbitrary file upload

CVE-2026-65461 · affected 1.3 and older · fixed in 1.3.1 · published 2026-07-23
critical 9.1 MapSVG

Arbitrary file upload

CVE-2026-65455 · affected 8.14.0 and older · fixed in 8.14.1 · published 2026-07-23
critical 9.1 Mailster WordPress Newsletter Plugin

Arbitrary file upload

CVE-2026-27064 · affected 4.1.17 and older · fixed in 4.1.18 · published 2026-07-23
critical 9.8 GoDAM

Arbitrary file upload

CVE-2026-14282 · affected 1.12.2 and older · fixed in 2.0.0 * · published 2026-07-23
high 7.2 MapSVG

Arbitrary file upload

CVE-2026-1771 · affected 8.14.0 and older · fixed in 8.14.1 * · published 2026-07-21
high 8.8 ProfilePress

Arbitrary file upload

CVE-2026-13352 · affected 4.16.18 and older · fixed in 4.16.19 * · published 2026-07-17
medium 6.5 Customer Reviews for WooCommerce

Arbitrary file upload

CVE-2026-12684 · affected older than 5.113.0 · fixed in 5.113.0 · published 2026-07-16
medium 5.3 Kali Forms

Arbitrary file upload

CVE-2026-11579 · affected older than 2.4.17 · fixed in 2.4.17 · published 2026-07-15
critical 9.8 Podlove Podcast Publisher

Arbitrary file upload

CVE-2026-13001 · affected 4.5.1 and older · fixed in 4.5.2 * · published 2026-07-14
high 8.8 Swiss Toolkit For WP

Arbitrary file upload

CVE-2026-2354 · affected 1.4.6 and older · fix not stated · published 2026-07-11
critical 9.8 Instant Appointment

Arbitrary file upload

CVE-2026-15282 · affected 1.2 and older · fix not stated · published 2026-07-10
high 7.2 Post Export Import with Media

Arbitrary file upload

CVE-2026-13430 · affected 1.13.1 and older · fixed in 1.13.2 * · published 2026-07-10
critical 9.8 Blocksy Companion

Arbitrary file upload

CVE-2026-15158 · affected 2.1.46 and older · fixed in 2.1.47 * · published 2026-07-09
high 8.8 WHMCS Bridge

Arbitrary file upload

CVE-2026-14489 · affected 6.9 and older · fix not stated · published 2026-07-08
critical 9.1 TemplateSpare

Arbitrary file upload

CVE-2026-57658 · affected 4.2.0 and older · fixed in 4.2.1 · published 2026-06-26
critical 9.9 Booster for WooCommerce

Arbitrary file upload

CVE-2026-56027 · affected 8.0.1 and older · fixed in 8.0.2 · published 2026-06-26
critical 10.0 Geeky Bot

Arbitrary file upload

CVE-2026-40772 · affected 1.2.2 and older · fixed in 1.2.3 · published 2026-06-15
critical 9.9 WP-BusinessDirectory

Arbitrary file upload

CVE-2026-39591 · affected 4.0.0 and older · fixed in 4.0.1 · published 2026-06-15
medium 5.4 WpStream

Arbitrary file upload

CVE-2026-39527 · affected older than 4.11.2 · fixed in 4.11.2 · published 2026-06-15
high 7.2 MDJM Event Management

Arbitrary file upload

CVE-2026-7537 · affected 1.7.8.3 and older · fixed in 1.7.8.4 * · published 2026-06-06
high 8.8 Advanced Google reCAPTCHA

Arbitrary file upload

CVE-2026-5411 · affected 5.38 and older · fixed in 5.39 * · published 2026-06-05
high 8.8 GutenBee

Arbitrary file upload

CVE-2026-9227 · affected 2.20.1 and older · fixed in 2.20.2 * · published 2026-05-28
critical 9.9 WPify Woo

Arbitrary file upload

CVE-2026-42748 · affected 5.4.1 and older · fixed in 5.4.2 · published 2026-05-27
critical 9.8 ProSolution WP Client

Arbitrary file upload

CVE-2026-6555 · affected 2.0.0 and older · fixed in 2.0.18 * · published 2026-05-20
critical 9.8 Career Section

Arbitrary file upload

CVE-2026-6271 · affected 1.7 and older · fixed in 1.8 * · published 2026-05-14
high 8.1 Drag and Drop File Upload for Contact Form 7

Arbitrary file upload

CVE-2026-5364 · affected 1.1.3 and older · fixed in 1.1.4 * · published 2026-04-24
critical 9.8 Breeze Cache

Arbitrary file upload

CVE-2026-3844 · affected 2.4.4 and older · fixed in 2.4.5 * · published 2026-04-23
high 8.8 CMP

Arbitrary file upload

CVE-2026-6518 · affected 4.1.16 and older · fixed in 4.1.17 * · published 2026-04-18
high 8.1 Drag and Drop Multiple File Upload for Contact…

Arbitrary file upload

CVE-2026-5718 · affected 1.3.9.7 and older · fixed in 1.3.9.8 * · published 2026-04-17
medium 5.3 Kubio AI Page Builder

Arbitrary file upload

CVE-2026-5427 · affected 2.7.2 and older · fixed in 2.7.3 * · published 2026-04-17
critical 9.8 Quick Playground

Arbitrary file upload

CVE-2026-1830 · affected 1.3.1 and older · fixed in 1.3.2 * · published 2026-04-09
critical 9.8 ProSolution WP Client

Arbitrary file upload

CVE-2026-2942 · affected 1.9.9 and older · fixed in 2.0.18 * · published 2026-04-08
high 7.2 Gerador de Certificados

Arbitrary file upload

CVE-2026-4808 · affected 1.3.6 and older · fix not stated · published 2026-04-08
critical 9.8 DSGVO Google Web Fonts GDPR

Arbitrary file upload

CVE-2026-3535 · affected 1.1 and older · fix not stated · published 2026-04-08
critical 9.9 WPJAM Basic

Arbitrary file upload

CVE-2026-32523 · affected 6.9.2 and older · fixed in 6.9.2.1 · published 2026-03-25
critical 9.1 Photo Engine (Media Organizer & Lightroom)

Arbitrary file upload

CVE-2026-32524 · affected 6.4.9 and older · fixed in 6.5.0 · published 2026-03-25
critical 9.1 Mobile App Editor

Arbitrary file upload

CVE-2026-27067 · affected 1.3.1 and older · fix not stated · published 2026-03-19
critical 9.8 Pix for WooCommerce

Arbitrary file upload

CVE-2026-3891 · affected 1.5.0 and older · fixed in 1.6.0 * · published 2026-03-13
high 8.8 Royal Addons for Elementor

Arbitrary file upload

CVE-2025-13067 · affected 1.7.1049 and older · fixed in 1.7.1050 * · published 2026-03-11
high 8.1 Drag and Drop Multiple File Upload for Contact…

Arbitrary file upload

CVE-2026-3459 · affected 1.3.9.5 and older · fixed in 1.3.9.6 * · published 2026-03-05
high 8.5 Filr

Arbitrary file upload

CVE-2026-28133 · affected 1.2.14 and older · fixed in 1.2.15 * · published 2026-03-05
critical 9.1 AI Engine

Arbitrary file upload

CVE-2026-23802 · affected 3.3.2 and older · fixed in 3.3.3 · published 2026-03-05
high 8.8 User Frontend

Arbitrary file upload

CVE-2026-1565 · affected 4.2.8 and older · fixed in 4.2.9 * · published 2026-02-26
critical 9.8 Slider Future

Arbitrary file upload

CVE-2026-1405 · affected 1.0.5 and older · fix not stated · published 2026-02-19
medium 5.3 Checkout Field Manager (Checkout Manager) for…

Arbitrary file upload

CVE-2025-12500 · affected 7.8.1 and older · fixed in 7.8.2 * · published 2026-02-19
critical 9.8 midi-Synth

Arbitrary file upload

CVE-2026-1306 · affected 1.1.0 and older · fix not stated · published 2026-02-14
critical 9.8 WPvivid

Arbitrary file upload

CVE-2026-1357 · affected 0.9.123 and older · fixed in 0.9.124 * · published 2026-02-11
high 8.8 WP Duplicate

Arbitrary file upload

CVE-2026-1499 · affected 1.1.8 and older · fixed in 1.1.9 * · published 2026-02-06
high 8.8 WP FOFT Loader

Arbitrary file upload

CVE-2026-1756 · affected 2.1.39 and older · fixed in 2.1.43 * · published 2026-02-04
high 8.8 OS DataHub Maps

Arbitrary file upload

CVE-2026-1730 · affected 1.8.3 and older · fixed in 1.8.4 * · published 2026-02-03
high 7.2 AI Engine

Arbitrary file upload

CVE-2026-1400 · affected 3.3.2 and older · fixed in 3.3.3 * · published 2026-01-28

Other types

Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution · Path traversal and file read · Authentication bypass · File inclusion · Server-side request forgery (SSRF) · Arbitrary file deletion · Open redirect · Denial of service · Content injection

Browse vulnerabilities

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Plugin versions, update dates and install counts: the wordpress.org Plugins API.
These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan