CVE-2021-24284

The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zipfile being unzipped in the wp-content/uploads/kaswara/fonts_icon directory with no checks for malicious files such as PHP.

• CWE-434

• http://packetstormsecurity.com/files/167743/WordPress-Kaswara-Modern-WPBakery-Page-Builder-3.0.1-File-Upload.htmlExploit, Third Party Advisory, VDB Entry
• https://codecanyon.net/item/kaswara-modern-visual-composer-addons/19341477Product, Third Party Advisory
• https://wpscan.com/vulnerability/8d66e338-a88f-4610-8d12-43e8be2da8c5Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/167743/WordPress-Kaswara-Modern-WPBakery-Page-Builder-3.0.1-File-Upload.htmlExploit, Third Party Advisory, VDB Entry
• https://codecanyon.net/item/kaswara-modern-visual-composer-addons/19341477Product, Third Party Advisory
• https://wpscan.com/vulnerability/8d66e338-a88f-4610-8d12-43e8be2da8c5Exploit, Third Party Advisory

Published

May 14, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-24279In the Redirection for Contact Form 7 WordPress plugin befor…6.5
• CVE-2021-2428Vulnerability in the Oracle Coherence product of Oracle Fusi…8.1
• CVE-2021-24280In the Redirection for Contact Form 7 WordPress plugin befor…8.8
• CVE-2021-24281In the Redirection for Contact Form 7 WordPress plugin befor…4.3
• CVE-2021-24282In the Redirection for Contact Form 7 WordPress plugin befor…6.3
• CVE-2021-24283The tab GET parameter of the settings page is not sanitised …5.4
• CVE-2021-24285The request_list_request AJAX call of the Car Seller - Auto …9.8
• CVE-2021-24286The settings page of the Redirect 404 to parent WordPress pl…6.1
• CVE-2021-24287The settings page of the Select All Categories and Taxonomie…6.1
• CVE-2021-24288When subscribing using AcyMailing, the 'redirect' parameter …6.1
• CVE-2021-24289There is functionality in the Store Locator Plus for WordPre…8.8
• CVE-2021-2429Vulnerability in the MySQL Server product of Oracle MySQL (c…5.9