CVE-2021-4449

CRITICAL EXPLOITED NUCLEI

ZoomSounds < 5.96 - Unauthenticated Arbitrary File Upload via savepng.php

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2021-4449 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2021-4457 is a duplicate of this.

Nuclei Templates (1)

ZoomSounds Plugin - Unauthenticated Arbitrary File Upload
CRITICALVERIFIEDby 0xnemian
FOFA: body="/wp-content/plugins/dzs-zoomsounds/"

References (6)

Core 6

Scores

CVSS v3 9.8
EPSS 0.0529
EPSS Percentile 91.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

VulnCheck KEV 2025-11-07
CWE
CWE-434
Status published
Products (2)
digitalzoomstudio/zoomsounds < 5.96
ZoomIt/ZoomSounds - WordPress Wave Audio Player with Playlist < 5.96
Published Oct 16, 2024
Tracked Since Feb 18, 2026