Vulnerabilities

TI-2026-05519 CVE-2026-6295 · GHSA-cv43-j772-67wp

WP Optimizer <= 2.5.0 - Authenticated (Administrator+) SQL Injection via 's' Parameter

LOW 23

The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00507 Published 2026-09-19 No fix listed CWE-89

TI-2026-59917 CVE-2026-87796 · GHSA-h7vp-g8q2-89c8

Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload

MEDIUM 51

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01141 Published 2026-09-17 No fix listed CWE-434

TI-2026-04892 CVE-2026-5581 · GHSA-56hx-w84f-pp3h

Multi Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion

MEDIUM 46

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00661 Published 2026-08-05 No fix listed CWE-862

TI-2025-13105 CVE-2025-14344 · GHSA-8v9v-hg7m-gpxf

Multi Uploader for Gravity Forms <= 1.1.7 - Unauthenticated Arbitrary File Deletion

MEDIUM 50

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'plupload_ajax_delete_file' function in all versions up to, and including…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00534 Published 2025-12-12 No fix listed CWE-22

TI-2025-33281 CVE-2025-53314 · GHSA-c3jv-8q67-qj5f

WordPress WP Optimizer plugin <= 2.5.0 - Cross Site Request Forgery (CSRF) vulnerability

MEDIUM 42

Cross-Site Request Forgery (CSRF) vulnerability in sh1zen WP Optimizer wp-optimizer allows SQL Injection.This issue affects WP Optimizer: from n/a through <= 2.5.0.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00165 Published 2025-06-27 No fix listed CWE-352

TI-2025-17688 CVE-2025-23921 · GHSA-x6x7-wx46-gh2c

WordPress Multi Uploader for Gravity Forms plugin <= 1.1.3 - Arbitrary File Upload vulnerability

MEDIUM 40

Unrestricted Upload of File with Dangerous Type vulnerability in sh1zen Multi Uploader for Gravity Forms gf-multi-uploader allows Upload a Web Shell to a Web Server.This issue affects Multi Uploader for Gravity Forms: fr…

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.00542 Published 2025-01-22 No fix listed CWE-434