Product
The Contact Manager plugin for WordPress contains an arbitrary file upload vulnerability (CVE-2026-109218) in the add_message function, potentially allowing remote code execution for unauthenticated attackers.