critical10.0
CVE-2026-4357
The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it po…
Impact
The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.
Affected products
| Product | Affected versions |
|---|---|
| Embed HTML5 Game WordPress Plugin | through 1.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.