8.8
Élevée
CVE-2025-13062 The Supreme Modules Lite plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and…
Description
The Supreme Modules Lite plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.5.62. This is due to insufficient file type validation detecting JSON files, allowing double extension files to bypass sanitization while being accepted as a valid JSON file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder 2.5 | premières → 2.5.62 | Pas de correctif indiqué |
Autres CVE de Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder
Les 4 CVE de Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder →
CVE-2024-5647
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups…
6.4
Moyenne
CVE-2024-5501
The Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder plugin for WordPress is vulnerable to Stored…
6.4
Moyenne
CVE-2024-4334
The Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder plugin for WordPress is vulnerable to DOM-Based…
6.4
Moyenne