HIGHVulnerability
Verified
Global

CISA KEV: iCagenda iCagenda — iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

Analysis

iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution. Added to CISA Known Exploited Vulnerabilities catalog on 2026-07-10. Remediation due: 2026-07-13.

Indicators of Compromise (1)

CVE (1)
CVE-2026-48939
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Jul 10, 2026. Verified by: CISA.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-94589 — The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirect...

The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the signature field's validation_filter(), combined with the absence of PHP-execution guards in the upload

CVE-2026-94589
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-107645 — The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation...

The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via add_filter('dokan_register_nonce_check', '__return_false')) and then trusting an attacker-supplied $_POST['role'] value when invoking wc_create_new_cu

CVE-2026-107645
NIST NVD
HIGHVulnerability

NVD HIGH: CVE-2026-104797 — The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress ...

The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to Authentication Bypass via Unverified Password Change in all versions up to, and including, 2.9.0 The `adfoin_ultimatememberac_send_data` function, which powers the Ultimate Member "Update Profile Field" action, resolves the target WordPress user from an attacker-supplied email address and passes an att

CVE-2026-104797
NIST NVD