CVE•Published 2026-09-02•Modified 2026-09-03•1 article on news•6 live references•NVD data
CVE-2026-4357
Vulnerability data via NVD (ingested)
CVSS v3.1
10.0
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS percentile
—
Weaknesses (CWE)
Description
The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.
Timeline
Published 2026-09-02
Modified 2026-09-03
External references
Search for exposed instances
Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).
More intel sources (5)
Shodan report
vuln:CVE-2026-4357Country / ASN / product breakdown for the vuln query.
Censys
vulnerabilities.cve_id: CVE-2026-4357Censys host search filtered to this CVE id.
grep.app
CVE-2026-4357Public source-code mentions — fast PoC discovery.
GitHub code
CVE-2026-4357GitHub code search for direct mentions.
Google dork
"CVE-2026-4357" exploit -site:nvd.nist.govWrite-ups and news, NVD excluded.
Known PoCs on GitHub (6)
CVE-2026-43576 repos
eeeeeeeeee-code/POCunknown
备份的漏洞库，3月开始我们来维护
Threekiii/CVEunknown
一个 CVE 漏洞预警知识库，无 exp/poc，部分包含修复方案。A knowledge base of CVE security vulnerability, no PoCs/exploits.
zoroqi/my-awesomeunknown
My Awesome List
brimstone/starsunknown
My starred GitHub repositories
ifannote/pocunknown
本项目是wy876漏洞库的备份,这里我们继承wy876佬的开源精神,所以这里备份这个项目。 免责声明： 文中所有涉及的内容均不针对任何厂商或个人，同时由于传播、利用文中所发布的技术或工具造成的任何直接或者间接的后果及损失，均由使用者本人承担。
J1ezds/some-starPython
github star 分类汇总