CVE-2025-10700

The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the enable_unfiltered_files_upload function. This makes it possible for unauthenticated attackers to enable unfiltered file upload and add svg files to the upload list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/changeset/3378763/
• https://research.cleantalk.org/cve-2025-10700
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f9190d35-c9e7-4190-8e66-f6066fe66af8?source=cve

Published

Oct 16, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-10693When SmartStart Inclusion fails during the onboarding of a Z…7.6
• CVE-2025-10694The User Feedback – Create Interactive Feedback Form, User S…5.3
• CVE-2025-10695Two unauthenticated diagnostic endpoints allow arbitrary bac…5.3
• CVE-2025-10696OpenSupports exposes an endpoint that allows the list of 'su…5.4
• CVE-2025-10699A vulnerability was reported in the Lenovo LeCloud client ap…6
• CVE-2025-1070CWE-434: Unrestricted Upload of File with Dangerous Type vul…8.1
• CVE-2025-10701The Time Clock – A WordPress Employee & Volunteer Time Clock…6.4
• CVE-2025-10702Improper Control of Generation of Code ('Code Injection') vu…8.6
• CVE-2025-10703Improper Control of Generation of Code ('Code Injection') vu…8.6
• CVE-2025-10705The MxChat – AI Chatbot for WordPress plugin for WordPress i…5.3
• CVE-2025-10706The Classified Pro theme for WordPress is vulnerable to unau…8.8
• CVE-2025-10707A weakness has been identified in JeecgBoot up to 3.8.2. Aff…8.8