CVE-2026-4357 — Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload

CVE-2026-4357

Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload PUBLISHED

Description (CNA)

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.

Affected (CNA)

Vendor / product	Versions
Unknown / Embed HTML5 Game	affected 0 through 1.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/b364969d-9dac-46ce-83e2-fc0fc2e5f698/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.