CVE-2025-7340 – “Elementor HT Contact Form Widget File Upload Vulnerability”

July 15, 2025

CVE ID : CVE-2025-7340

Published : July 15, 2025, 5:15 a.m. | 10 hours, 29 minutes ago

Description : The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the temp_file_upload function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site’s server which may make remote code execution possible.

Severity: 9.8 | CRITICAL

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Source: Read More

Previous ArticleCVE-2025-7341 – Elementor Page Builder & Gutenberg Blocks & Form Builder File Deletion Vulnerability

Next Article CVE-2025-5394 – Alone – Charity Multipurpose Non-profit WordPress Theme Unauthenticated Arbitrary File Upload Vulnerability

Highlights

CVE-2025-1863 – Yokogawa Electric Corporation Paperless Recorders Authentication Bypass

April 22, 2025

CVE ID : CVE-2025-1863

Published : April 18, 2025, 6:15 a.m. | 4 days, 7 hours ago

Description : Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authentication function is disabled on the affected products. Therefore, when connected to a network with default settings, anyone can access all functions related to settings and operations. As a result, an attacker can illegally manipulate and configure important data such as measured values and settings.
This issue affects GX10 / GX20 / GP10 / GP20 Paperless Recorders: R5.04.01 or earlier; GM Data Acquisition System: R5.05.01 or earlier; DX1000 / DX2000 / DX1000N Paperless Recorders: R4.21 or earlier; FX1000 Paperless Recorders: R1.31 or earlier; μR10000 / μR20000 Chart Recorders: R1.51 or earlier; MW100 Data Acquisition Units: All versions; DX1000T / DX2000T Paperless Recorders: All versions; CX1000 / CX2000 Paperless Recorders: All versions.

Severity: 9.8 | CRITICAL

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Akka introduces platform for distributed agentic AI

Design Patterns For AI Interfaces

Amazon launches spec-driven AI IDE, Kiro

This week in AI dev tools: Gemini API Batch Mode, Amazon SageMaker AI updates, and more (July 11, 2025)

AI-powered malware eludes Microsoft Defender’s security checks 8% of the time — with just 3 months of training and “reinforcement learning” for around $1,600

7 games that are perfect for handheld gaming PCs — with my favorite Steam Deck, ROG Ally, and Legion Go titles

Windows 11 Firewall with Advanced Security flags up errors in “under development” code — but it’s nothing to worry about

Metal Gear Solid Delta: Snake Eater — How to pre-order, release dates, story, gameplay, and everything else you need to know

The details of TC39’s last meeting

The details of TC39’s last meeting

Revolutionize Your IoT Management with Total.js IoT Platform: Simplify, Monitor, and Optimize

Creating a Brand Kit in Stream: Why It Matters and How It helps Organizations

AI-powered malware eludes Microsoft Defender’s security checks 8% of the time — with just 3 months of training and “reinforcement learning” for around $1,600

AI-powered malware eludes Microsoft Defender’s security checks 8% of the time — with just 3 months of training and “reinforcement learning” for around $1,600

7 games that are perfect for handheld gaming PCs — with my favorite Steam Deck, ROG Ally, and Legion Go titles

Windows 11 Firewall with Advanced Security flags up errors in “under development” code — but it’s nothing to worry about

CVE-2025-7340 – “Elementor HT Contact Form Widget File Upload Vulnerability”

CVE-2025-5393 – WordPress Alone Charity Multipurpose Non-profit Theme Arbitrary File Deletion Vulnerability

CVE-2025-5394 – Alone – Charity Multipurpose Non-profit WordPress Theme Unauthenticated Arbitrary File Upload Vulnerability

CVE-2025-5064 – Google Chrome Background Fetch API Cross-Origin Data Leak Vulnerability

I took a 130-pound power station off-grid for a week – here’s my buying advice

CVE-2025-43865 – React Router HTTP Header Injection Vulnerability

CVE-2025-5385 – JeeWMS Path Traversal Vulnerability

CVE-2025-1863 – Yokogawa Electric Corporation Paperless Recorders Authentication Bypass

CVE-2025-28102 – FlaskBlog XSS

Timeline Expectations: How Long Does It Really Take to Build an AI Solution?

Gemini in Google Sheets now lets you type a prompt to tell it exactly what to do

CVE-2025-7340 – “Elementor HT Contact Form Widget File Upload Vulnerability”

Related Posts