CVE-2025-23921criticalCWE-434

CVE-2025-23921: falha crítica em sh1zen Multi Uploader for Gravity Forms

WordPress Multi Uploader for Gravity Forms plugin <= 1.1.3 - Arbitrary File Upload vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Multi Uploader for Gravity Forms

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9epss 0.5%
Unrestricted Upload of File with Dangerous Type vulnerability in sh1zen Multi Uploader for Gravity Forms gf-multi-uploader allows Upload a Web Shell to a Web Server.This issue affects Multi Uploader for Gravity Forms: from n/a through <= 1.1.3.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
sh1zen · Multi Uploader for Gravity Forms
CVEs relacionadas — sh1zen Multi Uploader for Gravity Forms

No mesmo produto, das mais perigosas para as menos.

CVE-2026-87796CRITICALMulti Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File UploadEPSS 1.1%CVE-2026-5581CRITICALMulti Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media DeletionEPSS 0.7%CVE-2025-14344CRITICALMulti Uploader for Gravity Forms <= 1.1.7 - Unauthenticated Arbitrary File DeletionEPSS 0.5%