CVE-2026-4357
Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload
- State
- Published
- Severity
- 10.0 Critical
- Published
- Sep 2, 2026
- Updated
- Sep 2, 2026
- Reserved
- Mar 17, 2026
Description
The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 10.0 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | WPScan |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
Embed HTML5 GameUnknown |
|
References
- https://wpscan.com/vulnerability/b364969d-9dac-46ce-83e2-fc0fc2e5f698/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.