CVE-2026-4357 — Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload
The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthe…
Published: 2026-09-02 · CVSS: 10.0 · CVSS 3.1
The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7