CVE-2024-6494medium

CVE-2024-6494: falha de média gravidade em WordPress File Upload

WordPress File Upload < 4.24.8 - Unauthenticated Stored XSS

Publicada em

Seguir esta CVE+ Monitorar File Upload

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.1epss 0.4%
The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthenticated users to execute stored cross-site scripting (XSS) attacks.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
Unknown · WordPress File Upload
CVEs relacionadas — WordPress File Upload

No mesmo produto, das mais perigosas para as menos.

CVE-2024-6651MEDIUMWordPress File Upload < 4.24.8 - Reflected XSSEPSS 15.7%CVE-2021-24962—WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCEEPSS 2.8%CVE-2021-24961—WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via ShortcodeEPSS 0.7%CVE-2021-24960—WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVGEPSS 0.7%CVE-2023-4811MEDIUMWordPress File Upload < 4.23.3 - Author+ Stored Cross-Site ScriptingEPSS 0.5%