CVE-2021-4449
CRITICAL EXPLOITED NUCLEIDigitalzoomstudio Zoomsounds < 5.96 - Unrestricted File Upload
Title source: ruleDescription
The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2021-4457 is a duplicate of this.
Nuclei Templates (1)
ZoomSounds Plugin - Unauthenticated Arbitrary File Upload
CRITICALVERIFIEDby 0xnemian
FOFA:
body="/wp-content/plugins/dzs-zoomsounds/"
Scores
CVSS v3
9.8
EPSS
0.8080
EPSS Percentile
99.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
VulnCheck KEV
2025-11-07
CWE
CWE-434
Status
published
Products (2)
digitalzoomstudio/zoomsounds
< 5.96
ZoomIt/ZoomSounds - WordPress Wave Audio Player with Playlist
< 5.96
Published
Oct 16, 2024
Tracked Since
Feb 18, 2026