CVE-2015-9272

9.8 criticalEPSS 5.0%

Critical (9.8) in videowhisper video presentation. EPSS 5.0% chance of exploitation in the next 30 days.

The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 5.0% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2018-10-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

videowhisper:video_presentation

References

http://www.vapidlabs.com/advisory.php?v=117
https://www.openwall.com/lists/oss-security/2015/04/01/2
http://www.vapidlabs.com/advisory.php?v=117
https://www.openwall.com/lists/oss-security/2015/04/01/2

Check your stack JSON