Back to Database
Status published
Medium
CVE-2019-25295
WP Cost Estimation < 9.660 - Upload Directory Traversal
Vulnerability Description
The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles function. This allows attackers to overwrite any file with a whitelisted type on an affected site.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-25295
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Mikey Veenstra
References
More from loopus
View All →CVE-2025-60155
WordPress WP Virtual Assistant Plugin <= 3.0 - Broken Access Control Vulnerability
Medium
5.3
CVE-2025-58999
WordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - Cross Site Request Forgery (CSRF) vulnerability
Medium
4.3
CVE-2025-58956
WordPress WP Attractive Donations System Plugin < 1.29 - Cross Site Request Forgery (CSRF) Vulnerability
High
7.1
CVE-2025-31921
WordPress WP Ultimate Tours Builder plugin <= 1.055 - Cross Site Request Forgery (CSRF) Vulnerability
Medium
4.3
CVE-2025-22725
WordPress WP Virtual Assistant plugin <= 3.1 - Cross Site Scripting (XSS) vulnerability
High
7.1
Affected Vendor
loopus
View all reports →Affected Software
WP Cost Estimation & Payment Forms Builder
Vulnerable Versions:
0
Timeline
Official Publish:
January 8th, 2026
Last Modified:
April 8th, 2026
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L