Sh1zen vulnerabilities
We track 5 vulnerabilities in Sh1zen products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 17, 2026.
Latest Sh1zen vulnerabilities
- 9.8 Critical severity
Multi Uploader for Gravity Forms: Unrestricted Upload of File with Dangerous Type
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This makes
- 9.1 Critical severity
Multi Uploader for Gravity Forms: Missing Authorization
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the `plupload_ajax_delete_file()` function, which is regis
- 9.8 Critical severity
Multi Uploader for Gravity Forms: Improper Limitation of a Pathname to a Restricted Directory
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'plupload_ajax_delete_file' function in all versions up to, and including, 1.1.7. This makes it possible for unau
- 9.6 Critical severity
WP Optimizer: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in sh1zen WP Optimizer wp-optimizer allows SQL Injection.This issue affects WP Optimizer: from n/a through <= 2.5.0.
- 9.0 Critical severity
Multi Uploader for Gravity Forms: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in sh1zen Multi Uploader for Gravity Forms gf-multi-uploader allows Upload a Web Shell to a Web Server.This issue affects Multi Uploader for Gravity Forms: from n/a through <= 1.1.3.