WordPress Plugin Vulnerabilities

Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload

Description

The plugin does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.

Proof of Concept

Affects Plugins

Plugin icon
embed-html5-game
No known fix

References

CVE
CVE-2026-4357

Miscellaneous

Original Researcher
Mike Gozdiskowski
Submitter
Mike Gozdiskowski
Verified
Yes
WPVDB ID
b364969d-9dac-46ce-83e2-fc0fc2e5f698

Timeline

Publicly Published
2026-04-21 (about 4 months ago)
Added
2026-04-21 (about 4 months ago)
Last Updated
2026-09-02 (about 2 hours ago)

Other

Published
Title
Published
2015-04-02
Title
PHP Event Calendar <= 1.5 - Arbitrary File Upload
Published
2026-01-05
Title
Corpkit < 2.0.1 - Authenticated (Subscriber+) Arbitrary File Upload
Published
2022-04-11
Title
Import WP < 2.4.6 - Admin+ Arbitrary File Upload to RCE
Published
2024-11-19
Title
Fediverse Embeds < 1.5.4 - Unauthenticated Arbitrary File Upload
Published
2026-03-03
Title
Nutrie < 2.0.1 - Authenticated (Subscriber+) Arbitrary File Upload