blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2019-25295

MEDIUM 6.5 CVSS 3.1
Published
January 8, 2026
Last modified
June 17, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-22
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Description

The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles function. This allows attackers to overwrite any file with a whitelisted type on an affected site.

Affected products and versions

  • loopus WP Cost Estimation & Payment Forms Builder — Before 9.660

References

  • codecanyon.net https://codecanyon.net/item/wp-cost-estimation-payment-forms-builder/7818230
  • www.wordfence.com https://www.wordfence.com/blog/2019/02/vulnerabilities-patched-in-wp-cost-estimation-plugin/
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/65a9e877-e870-4e36-985d-c0629abe3f78?source=cve
  • nvd.nist.gov Official NVD record