CVE-2024-2847: fallo de gravedad media en nickboss Iptanus File Upload
WordPress File Upload <= 4.24.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.4epss 0.4%
The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.24.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Productos afectados
nickboss · Iptanus File UploadCVEs relacionadas — nickboss Iptanus File Upload
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-9047CRITICALWordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.phpEPSS 93.3%CVE-2024-11613CRITICALWordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File DeletionEPSS 4.4%CVE-2023-2688MEDIUMWordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Path TraversalEPSS 1.7%CVE-2024-11635CRITICALWordPress File Upload <= 4.24.12 - Unuathenticated Remote Code ExecutionEPSS 1.5%CVE-2024-9939HIGHWordPress File Upload <= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.phpEPSS 1.0%CVE-2024-5852MEDIUMWordPress File Upload <= 4.24.7 - Authenticated (Contributor+) Directory TraversalEPSS 0.7%