The Bravis‑Themes Bravis Addons plugin up through version 1.3.0 suffers from an unrestricted upload vulnerability that permits an attacker to upload files with dangerous content. Because the plugin does not enforce file type validation or size limits, an adversary can upload executable scripts, web shells or cross‑site scripting payloads. Successful exploitation could lead to remote code execution, data exfiltration or denial of service against the WordPress site.

Any WordPress site that has Bravis Addons installed with a version no later than 1.3.0 is affected. The plugin vendor, Bravis‑Themes, acknowledges that all releases from the first public launch up to 1.3.0 lack proper upload filtering. Sites migrating to the official WordPress repository remain vulnerable until they update.

The CVSS score of 9.9 indicates critical severity. The EPSS score is under 1%, suggesting that exploit attempts are rare, and the vulnerability is not currently listed in the CISA KEV catalog. Nevertheless, attackers can leverage common file upload techniques; the threat is still substantial because the flaw originates in the plugin core, not merely an external dependency. The attack vector is inferred to be web‑based, typically through the plugin’s upload interface, without requiring privileged credentials.