CVE-2015-1376: Pixabay Images Project Pixabay Images

Medium severity, CVSS 4.0. EPSS: 33.1% chance of exploitation in the next 30 days.

pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host other than pixabay.com.

Affected products

• Pixabay Images Project Pixabay Images: up to and including 2.3

Published 2015-01-28. Last modified 2026-06-17.