Sammy Forgit

The issue allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a .php.ttf extension to the font-upload.php file in the Font Uploader plugin, and then accessing it via a direct request to the file in font-uploader/fonts.

The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the preview.php file. This is achieved by using a .. (dot dot) in the `data` parameter.

The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the includes/doajaxfileupload.php file, and then accessing it via a direct request to the file in upload/temp.

The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the `uploader.php` file, and then accessing it via a direct request to the file in `uploads/rbxslider`.

The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the `php/upload.php` endpoint, and then accessing it via a direct request to the file in `uploads/wpstorecart`.