Read the docs

nickboss

Records28All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high8CVSS 7.0–8.9

Exploited now

nickboss records in CISA KEV

No nickboss vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wordpress File Upload 25 records CRITICAL Wordpress File Upload Pro 5 records MEDIUM

Records

5 records in Wordpress File Upload Pro · all components

TI-2021-07241 CVE-2021-24962 · GHSA-x2qc-gfcm-c5m4

WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCE

Priority MEDIUM 43

The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode argument, which can then be used to upload a PHP code disguis…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02805 Published 2022-03-28 Fixed in 4.16.3 CWE-22
TI-2021-07240 CVE-2021-24961 · GHSA-v8xx-gxhg-qqpr

WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Shortcode

Priority LOW 26

The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 does not escape some of its shortcode argument, which could allow users with a role as low as Contributor…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00674 Published 2022-03-07 Fixed in 4.16.3 CWE-79
TI-2021-07239 CVE-2021-24960 · GHSA-g533-q4qm-q7jp

WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVG

Priority LOW 26

The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploadin…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00674 Published 2022-03-07 Fixed in 4.16.3 CWE-434
TI-2023-02591 CVE-2023-2767 · GHSA-65xg-x39w-4v93

WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

Priority LOW 25

The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.19.1 due to insufficient input sanitizati…

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00376 Published 2023-06-09 No fix listed CWE-79
Open these records in search →