CRITICAL 10.0 NVD

CVE-2026-4357

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it pos

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.

References

https://wpscan.com/vulnerability/b364969d-9dac-46ce-83e2-fc0fc2e5f698/

Published: 2026-09-02 · Source: NVD · Feed updated: 2026-09-02

This critical severity vulnerability with a CVSS score of 10.0 was published on 2026-09-02 via NVD.

Risk Timeline

CVE Disclosed2026-09-02 · -1 days ago

Remediation Resources

Official Advisory

wpscan.com/vulnerability/b364969d-9dac-46ce-83e2-fc0fc2e5f698/

vulnfeed aggregates 11639 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.