sh1zen vulnerabilities

Products

• Multi Uploader for Gravity Forms 4
• WP Optimizer 1
• WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals 1

Latest sh1zen CVEs

Newest publication first

1. CVE-2026-6295 WP Optimizer <= 2.5.0 - Authenticated (Administrator+) SQL Injection via 's' Parameter

   Published 2026-09-19

   Medium·CVSS 4.9 EPSS 0.51%

   The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parse_key_compare_field() method that, when the user-supplied value matches the r...

2. CVE-2026-87796 Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload

   Published 2026-09-17

   Critical·CVSS 9.8 EPSS 1.1%

   The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for una...

3. CVE-2026-5581 Multi Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion

   Published 2026-08-05

   Critical·CVSS 9.1 EPSS 0.66%

   The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the plupload_ajax_delete_file() function, which is registered via wp_ajax_nopr...

4. CVE-2025-14344 Multi Uploader for Gravity Forms <= 1.1.7 - Unauthenticated Arbitrary File Deletion

   Published 2025-12-12

   Critical·CVSS 9.8 EPSS 0.57%

   The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'plupload_ajax_delete_file' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attacker...

5. CVE-2025-53314 WordPress WP Optimizer plugin <= 2.5.0 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2025-06-27

   Critical·CVSS 9.6 EPSS 0.17%

   Cross-Site Request Forgery (CSRF) vulnerability in sh1zen WP Optimizer wp-optimizer allows SQL Injection.This issue affects WP Optimizer: from n/a through <= 2.5.0.

6. CVE-2025-23921 WordPress Multi Uploader for Gravity Forms plugin <= 1.1.3 - Arbitrary File Upload vulnerability

   Published 2025-01-22

   Critical·CVSS 9.0 EPSS 0.54%

   Unrestricted Upload of File with Dangerous Type vulnerability in sh1zen Multi Uploader for Gravity Forms gf-multi-uploader allows Upload a Web Shell to a Web Server.This issue affects Multi Uploader for Gravity Forms: from n/a through <= 1.1.3.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.