CVE-2021-24960: fallo en WordPress File Upload
WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVG
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 0.7%
The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks
CVEs relacionadas — WordPress File Upload
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-6651MEDIUMWordPress File Upload < 4.24.8 - Reflected XSSEPSS 15.7%CVE-2021-24962—WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCEEPSS 2.8%CVE-2021-24961—WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via ShortcodeEPSS 0.7%CVE-2023-4811MEDIUMWordPress File Upload < 4.23.3 - Author+ Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-6494MEDIUMWordPress File Upload < 4.24.8 - Unauthenticated Stored XSSEPSS 0.4%