Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: nickboss Component: Wordpress File Upload Pro Clear all filters
TI-2023-02591 CVE-2023-2767 · GHSA-65xg-x39w-4v93

WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

Priority LOW 25

The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.19.1 due to insufficient input sanitizati…

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00376 Published 2023-06-09 No fix listed CWE-79
TI-2021-07241 CVE-2021-24962 · GHSA-x2qc-gfcm-c5m4

WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCE

Priority MEDIUM 43

The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode argument, which can then be used to upload a PHP code disguis…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02805 Published 2022-03-28 Fixed in 4.16.3 CWE-22
TI-2021-07240 CVE-2021-24961 · GHSA-v8xx-gxhg-qqpr

WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Shortcode

Priority LOW 26

The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 does not escape some of its shortcode argument, which could allow users with a role as low as Contributor…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00674 Published 2022-03-07 Fixed in 4.16.3 CWE-79
TI-2021-07239 CVE-2021-24960 · GHSA-g533-q4qm-q7jp

WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVG

Priority LOW 26

The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploadin…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00674 Published 2022-03-07 Fixed in 4.16.3 CWE-434