Threat database

The WP CV Builder plugin for WordPress has a vulnerability allowing unauthenticated attackers to upload arbitrary PNG files due to missing authorization checks in the 'wp_save_signature_image' function. This affects all versions up to and including 1.3.1. The vulnerability can lead to unauthorized file uploads to the WordPress uploads directory.

Deserialization of Untrusted Data vulnerability in BestWpDeveloper WooCommerce Product Multi-Action Woo-product-multiaction allows Object Injection.This issue affects WooCommerce Product Multi-Action: from n/a through <= 1.3.

The BWD Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.18 in widgets/bwdeb-content-switcher.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.