Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: All in One Files Upload 2.0.17 Clear all filters
TI-2026-58701 CVE-2026-85576 · GHSA-xrrq-7x9p-r92r

All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update

Priority LOW 19

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a sub…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00152 Published 2026-09-30 Fixed in 2.0.17 CWE-862
TI-2026-58698 CVE-2026-85573 · GHSA-c54q-hhx6-vc6r

All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload

Priority MEDIUM 40

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticat…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00276 Published 2026-09-30 Fixed in 2.0.17 CWE-79