Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
patch is 13c30af721d3f989caac72dd0f56cf0dc40fad7e. It is recommended to upgrade the affected component. The identifier VDB-241317 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.241317 - https://vuldb.com/?ctiid.241317 - https://github.com/wp-plugins/wp-ultimate-csv-importer/commit/13c30af721d3f989caac72dd0f56cf0dc40fad7e - https://github.com/wp-plugins/wp-ultimate-csv-importer/releases/tag/3.7.3
CVE ID: CVE-2015-10126 State: PUBLISHED Published: 2023-10-06T08:00:04.475Z Last Updated: 2025-06-16T17:09:17.565Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: Easy2Map Photos Plugin Problem Types: CWE-89 Description: A vulnerability classified as critical was found in Easy2Map Photos Plugin 1.0.1 on WordPress. This vulnerability affects unknown code. The manipulation leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.1.0 is able to address this issue. The patch is identified as 503d9ee2482d27c065f78d9546f076a406189908. It is recommended to upgrade the affected component. VDB-241318 is the identifier assigned to this vulnerabili
06189908. It is recommended to upgrade the affected component. VDB-241318 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.241318 - https://vuldb.com/?ctiid.241318 - https://github.com/wp-plugins/easy2map-photos/commit/503d9ee2482d27c065f78d9546f076a406189908
CVE ID: CVE-2015-10127 State: PUBLISHED Published: 2023-12-26T17:00:04.667Z Last Updated: 2024-11-21T14:11:26.572Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: PlusCaptcha Plugin Problem Types: CWE-79 Description: A vulnerability was found in PlusCaptcha Plugin up to 2.0.6 on WordPress and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.0.14 is able to address this issue. The patch is identified as 1274afc635170daafd38306487b6bb8a01f78ecd. It is recommended to upgrade the affected component. VDB-248954 is the identifier assig
5170daafd38306487b6bb8a01f78ecd. It is recommended to upgrade the affected component. VDB-248954 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.248954 - https://vuldb.com/?ctiid.248954 - https://github.com/wp-plugins/pluscaptcha/commit/1274afc635170daafd38306487b6bb8a01f78ecd
CVE ID: CVE-2015-10128 State: PUBLISHED Published: 2024-01-02T13:31:03.041Z Last Updated: 2025-04-17T18:38:12.123Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: rt-prettyphoto Plugin Problem Types: CWE-79 Description: A vulnerability was found in rt-prettyphoto Plugin up to 1.2 on WordPress and classified as problematic. Affected by this issue is the function royal_prettyphoto_plugin_links of the file rt-prettyphoto.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3 is able to address this issue. The patch is identified as 0d3d38cfa487481b66869e4212df1cefc281ecb7. It is recommended to upgrade the affec
this issue. The patch is identified as 0d3d38cfa487481b66869e4212df1cefc281ecb7. It is recommended to upgrade the affected component. VDB-249422 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249422 - https://vuldb.com/?ctiid.249422 - https://github.com/wp-plugins/rt-prettyphoto/commit/0d3d38cfa487481b66869e4212df1cefc281ecb7
CVE ID: CVE-2015-10129 State: PUBLISHED Published: 2024-02-04T04:31:03.305Z Last Updated: 2024-08-06T08:58:26.521Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: planet-freo Problem Types: CWE-697 Description: A vulnerability was found in planet-freo up to 20150116 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/inc/auth.inc.php. The manipulation of the argument auth leads to incorrect comparison. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. This product
. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is 6ad38c58a45642eb8c7844e2f272ef199f59550d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-252716. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.252716 - https://vuldb.com/?ctiid.252716 - https://github.com/samwilson/planet-freo/commit/6ad38c58a45642eb8c7844e2f272ef199f59550d
CVE ID: CVE-2015-10130 State: PUBLISHED Published: 2024-03-13T02:34:52.050Z Last Updated: 2024-08-11T13:54:25.938Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: nik00726 Products: Team Circle Image Slider With Lightbox Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the circle_thumbnail_slider_with_lightbox_image_management_func() function. This makes it possible for unauthenticated attackers to edit image data which can be used to inject malicious JavaScrip
This makes it possible for unauthenticated attackers to edit image data which can be used to inject malicious JavaScript, along with deleting images, and uploading malicious files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b6a54470-fc66-43c5-a523-ddbefd47ee1f?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1269993%40circle-image-slider-with-lightbox&new=1269993%40circle-image-slider-with-lightbox&sfp_email=&sfph_mail=
CVE ID: CVE-2015-10131 State: PUBLISHED Published: 2024-03-31T06:00:04.326Z Last Updated: 2024-08-06T08:58:26.389Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: chrisy Products: TFO Graphviz Plugin Problem Types: CWE-79 Description: A vulnerability was found in chrisy TFO Graphviz Plugin up to 1.9 on WordPress and classified as problematic. Affected by this issue is the function admin_page_load/admin_page of the file tfo-graphviz-admin.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.10 is able to address this issue. The name of the patch is 594c953a345f79e26003772093b0caafc14b92c2. It is recommended to upgrade the
address this issue. The name of the patch is 594c953a345f79e26003772093b0caafc14b92c2. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-258620. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258620 - https://vuldb.com/?ctiid.258620 - https://github.com/wp-plugins/tfo-graphviz/commit/594c953a345f79e26003772093b0caafc14b92c2 - https://github.com/wp-plugins/tfo-graphviz/releases/tag/1.10
CVE ID: CVE-2015-10132 State: PUBLISHED Published: 2024-04-21T19:31:04.425Z Last Updated: 2024-08-06T08:58:26.418Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Thimo Grauerholz Products: WP-Spreadplugin Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in Thimo Grauerholz WP-Spreadplugin up to 3.8.6.1 on WordPress. This vulnerability affects unknown code of the file spreadplugin.php. The manipulation of the argument Spreadplugin leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.8.6.6 is able to address this issue. The name of the patch is a9b9afc641854698e80aa5dd9ababfc8e0e57d69. It is recommended to
6 is able to address this issue. The name of the patch is a9b9afc641854698e80aa5dd9ababfc8e0e57d69. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-261676. Additional Analyst Notes: - ADP Container: - CVE Program Container: References: - https://vuldb.com/?id.261676 - https://vuldb.com/?ctiid.261676 - https://github.com/wp-plugins/wp-spreadplugin/commit/a9b9afc641854698e80aa5dd9ababfc8e0e57d69 - https://github.com/wp-plugins/wp-spreadplugin/releases/tag/3.8.6.6
CVE ID: CVE-2015-10133 State: PUBLISHED Published: 2025-07-19T09:23:53.160Z Last Updated: 2025-07-21T16:24:16.756Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: markjaquith Products: Subscribe to Comments Problem Types: CWE-98 Description: The Subscribe to Comments for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.1.2 via the Path to header value. This allows authenticated attackers, with administrative privileges and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code executi
any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This same function can also be used to execute arbitrary PHP code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f92784a7-f2b3-47f8-b03f-4e234b57e40a?source=cve - https://advisories.dxw.com/advisories/admin-only-local-file-inclusion-and-arbitrary-code-execution-in-subscribe-to-comments-2-1-2/ - https://seclists.org/fulldisclosure/2015/Jul/71 - https://packetstormsecurity.com/files/132694/ - https://plugins.trac.wordp
s://seclists.org/fulldisclosure/2015/Jul/71 - https://packetstormsecurity.com/files/132694/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1198281%40subscribe-to-comments&new=1198281%40subscribe-to-comments&sfp_email=&sfph_mail=
CVE ID: CVE-2015-10134 State: PUBLISHED Published: 2025-07-19T09:23:51.043Z Last Updated: 2025-07-21T18:11:36.679Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: mywebsiteadvisor Products: Simple Backup Problem Types: CWE-22 Description: The Simple Backup plugin for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 2.7.10. via the download_backup_file function. This is due to a lack of capability checks and file type validation. This makes it possible for attackers to download sensitive files such as the wp-config.php file from the affected site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wo
-config.php file from the affected site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/29482b70-0ff2-4bb1-9d41-9cffb83b5ad0?source=cve - https://packetstormsecurity.com/files/131919/
CVE ID: CVE-2015-10135 State: PUBLISHED Published: 2025-07-19T09:23:52.009Z Last Updated: 2025-07-21T16:50:05.690Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: eoxia Products: WPshop 2 – E-Commerce Problem Types: CWE-434 Description: The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxUpload function in versions before 1.3.9.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/thr
code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/32e8224d-a653-48d7-a3f4-338fc0c1dc77?source=cve - https://g0blin.co.uk/g0blin-00036/ - https://github.com/espreto/wpsploit/blob/master/modules/exploits/unix/webapp/wp_wpshop_ecommerce_file_upload.rb - https://wordpress.org/plugins/wpshop/#developers - https://plugins.trac.wordpress.org/changeset/1103406
CVE ID: CVE-2015-10136 State: PUBLISHED Published: 2025-07-19T09:23:51.606Z Last Updated: 2025-07-21T16:53:44.202Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: zishanj Products: GI-Media Library Problem Types: CWE-22 Description: The GI-Media Library plugin for WordPress is vulnerable to Directory Traversal in versions before 3.0 via the 'fileid' parameter. This allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2f80c3b9-5148-42eb-9137-9c538184cda3?source=cve
References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2f80c3b9-5148-42eb-9137-9c538184cda3?source=cve - http://wordpressa.quantika14.com/repository/index.php?id=24 - https://github.com/espreto/wpsploit/blob/master/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb - https://wpscan.com/vulnerability/7754 - https://wordpress.org/plugins/gi-media-library/#developers - https://plugins.trac.wordpress.org/changeset/1132677 - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wp_gimedia_library_file_read/
CVE ID: CVE-2015-10137 State: PUBLISHED Published: 2025-07-22T01:44:28.648Z Last Updated: 2025-07-22T19:49:36.892Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: N-Media Products: Website Contact Form With File Upload Problem Types: CWE-434 Description: The Website Contact Form With File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_file()' function in versions up to, and including, 1.3.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnr
s on the affected sites server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8395e0c4-3feb-4551-9f2f-7b80cd187eca?source=cve - https://www.homelab.it/index.php/2015/04/12/wordpress-n-media-website-contact-form-shell-upload/ - https://packetstormsecurity.com/files/131413/ - https://packetstormsecurity.com/files/131514/ - https://plugins.trac.wordpress.org/browser/website-contact-form-with-file-upload/trunk/readme.txt - https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-n-media-website-contact-form-with-file-upload-arbitrary-file-upload-1-3-4/ - https://plugins
lities/web/wordpress-plugin-n-media-website-contact-form-with-file-upload-arbitrary-file-upload-1-3-4/ - https://plugins.trac.wordpress.org/browser/website-contact-form-with-file-upload/trunk/readme.txt#L147
CVE ID: CVE-2015-10138 State: PUBLISHED Published: 2025-07-19T11:23:38.202Z Last Updated: 2025-07-21T15:41:54.925Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: lynton_reed Products: Work The Flow File Upload Problem Types: CWE-434 Description: The Work The Flow File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jQuery-File-Upload-9.5.0 server and test files in versions up to, and including, 2.5.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vul
les on the affected sites server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eb271cc8-01ec-45eb-9d6f-efc55c7c3923?source=cve - https://www.homelab.it/index.php/2015/04/04/wordpress-work-the-flow-file-upload-vulnerability/ - https://packetstormsecurity.com/files/131294/ - https://packetstormsecurity.com/files/131512/ - https://wpscan.com/vulnerability/a49a81a9-3d4b-4c8d-b719-fc513aceecc6 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1127456%40work-the-flow-file-upload&new=1127456%40work-the-flow-file-upload&sfp_email=&sfph_mail= - h
ail=&reponame=&old=1127456%40work-the-flow-file-upload&new=1127456%40work-the-flow-file-upload&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1127457%40work-the-flow-file-upload&new=1127457%40work-the-flow-file-upload&sfp_email=&sfph_mail= - https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-work-the-flow-file-upload-arbitrary-file-upload-2-5-2/ - https://www.rapid7.com/db/modules/exploit/unix/webapp/wp_worktheflow_upload/
CVE ID: CVE-2015-10139 State: PUBLISHED Published: 2025-07-19T11:23:36.517Z Last Updated: 2025-07-21T15:41:24.264Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: VibeThemes Products: WPLMS Learning Management System for WordPress, WordPress LMS Problem Types: CWE-269 Description: The WPLMS theme for WordPress is vulnerable to Privilege Escalation in versions 1.5.2 to 1.8.4.1 via the 'wp_ajax_import_data' AJAX action. This makes it possible for authenticated attackers to change otherwise restricted settings and potentially create a new accessible admin account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-in
ible admin account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6e0e8f5f-8216-4276-a810-860f9b52c447?source=cve - https://packetstormsecurity.com/files/130291/ - https://www.rapid7.com/db/modules/auxiliary/admin/http/wp_wplms_privilege_escalation/ - https://twitter.com/_wpscan_/status/564874637679820800?lang=ca - https://wpscan.com/vulnerability/7785 - https://themeforest.net/item/wplms-learning-management-system/6780226
CVE ID: CVE-2015-10140 State: PUBLISHED Published: 2025-07-22T13:20:59.054Z Last Updated: 2025-07-22T13:44:53.208Z Vendors: Unknown Products: Ajax Load More Problem Types: CWE-862 Missing Authorization Description: The Ajax Load More plugin before 2.8.1.2 does not have authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber, to upload and delete arbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9f0c926e-0609-4c89-a724-88e16bcfa82a
CVE ID: CVE-2015-10141 State: PUBLISHED Published: 2025-07-23T13:53:23.238Z Last Updated: 2025-07-23T14:34:02.348Z Vendors: Xdebug Products: Xdebug Problem Types: CWE-78, CWE-306 Description: An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the priv
invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://xdebug.org/ - https://kirtixs.com/blog/2015/11/13/xpwn-exploiting-xdebug-enabled-servers/ - http://web.archive.org/web/20231226215418/https://paper.seebug.org/397/ - https://www.exploit-db.com/exploits/44568 - https://www.fortiguard.com/encyclopedia/ips/46000 - https://www.vulncheck.com/advisories/xdebug-remote-debugger-unauth-os-command-execution
CVE ID: CVE-2015-10142 State: PUBLISHED Published: 2025-07-25T15:55:07.308Z Last Updated: 2025-11-21T15:27:52.170Z Vendors: Sitecore Products: Experience Platform (XP), Content Management System (CMS) Problem Types: CWE-610 Description: Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev. 141212) and Content Management System (CMS) prior to 7.2 Update-3 (rev. 141226) and prior to 7.5 Update-1 (rev. 150130) contain a vulnerability that may allow an attacker to download files under the web root of the site when the name of the file is already known via a specially-crafted URL. Affected files do not include .config, .aspx or .cs files. The issue does not allow for directory brow
ally-crafted URL. Affected files do not include .config, .aspx or .cs files. The issue does not allow for directory browsing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0816762 - https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002377 - https://www.vulncheck.com/advisories/sitecore-xp-cms-file-read-via-known-path
CVE ID: CVE-2015-10143 State: PUBLISHED Published: 2025-07-25T02:23:58.149Z Last Updated: 2025-07-25T17:25:38.485Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PageLines Products: Platform Problem Types: CWE-862 Description: The Platform theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the *_ajax_save_options() function in all versions up to 1.4.4 (exclusive). This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable use
on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c16fab08-6b2c-433a-9105-fc15f5c52575?source=cve - https://blog.sucuri.net/2015/01/security-advisory-vulnerabilities-in-pagelinesplatform-theme-for-wordpress.html - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_platform_exec.rb
CVE ID: CVE-2015-10144 State: PUBLISHED Published: 2025-07-25T02:23:57.529Z Last Updated: 2025-07-25T17:29:45.316Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: nik00726 Products: Thumbnail carousel slider Problem Types: CWE-434 Description: The Responsive Thumbnail Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type sanitization in the via the image uploader in versions up to 1.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected sites server using a double extension which may make remote code execution possible. Additional Analyst
on the affected sites server using a double extension which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6c396ae6-d34c-4554-b670-28868dc136a5?source=cve - https://cxsecurity.com/issue/WLB-2015080170 - https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-thumbnail-carousel-slider-arbitrary-file-upload-1-0/ - https://www.exploit-db.com/exploits/37998 - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/wp_responsive_thumbnail_slider_upload.rb