CVE-2023-4811: falha de média gravidade em WordPress File Upload
WordPress File Upload < 4.23.3 - Author+ Stored Cross-Site Scripting
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.5%
The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
Unknown · WordPress File UploadCVEs relacionadas — WordPress File Upload
No mesmo produto, das mais perigosas para as menos.
CVE-2024-6651MEDIUMWordPress File Upload < 4.24.8 - Reflected XSSEPSS 15.7%CVE-2021-24962—WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCEEPSS 2.8%CVE-2021-24961—WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via ShortcodeEPSS 0.7%CVE-2021-24960—WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVGEPSS 0.7%CVE-2024-6494MEDIUMWordPress File Upload < 4.24.8 - Unauthenticated Stored XSSEPSS 0.4%