8.8
High
CVE-2025-13062 The Supreme Modules Lite plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and…
Description
The Supreme Modules Lite plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.5.62. This is due to insufficient file type validation detecting JSON files, allowing double extension files to bypass sanitization while being accepted as a valid JSON file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder 2.5 | earliest → 2.5.62 | No fix stated |
Other CVEs of Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder
The 4 CVEs of Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder →
CVE-2024-5647
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups…
6.4
Medium
CVE-2024-5501
The Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder plugin for WordPress is vulnerable to Stored…
6.4
Medium
CVE-2024-4334
The Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder plugin for WordPress is vulnerable to DOM-Based…
6.4
Medium