Vulnerabilities

TI-2021-13639 CVE-2021-34625 · GHSA-2r5h-m86c-qqjm

WP Upload Restriction <= 2.2.3 - Authenticated Stored Cross-Site Scripting

LOW 29

A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scripts.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00634 Published 2021-07-07 No fix listed CWE-79

TI-2021-13641 CVE-2021-34627 · GHSA-335f-9mr2-fg88

WP Upload Restriction <= 2.2.3 - Missing Access Control in getSelectedMimeTypesByRole function

LOW 21

A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extensions added by administrators.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.007 Published 2021-07-07 No fix listed CWE-284

TI-2021-13640 CVE-2021-34626 · GHSA-2935-f8mx-xc5w

WP Upload Restriction <= 2.2.3 - Missing Access Control in deleteCustomType function

LOW 21

A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions added by administrators.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0069 Published 2021-07-07 No fix listed CWE-284

Vulnerabilities

Filters

WP Upload Restriction <= 2.2.3 - Authenticated Stored Cross-Site Scripting

WP Upload Restriction <= 2.2.3 - Missing Access Control in getSelectedMimeTypesByRole function

WP Upload Restriction <= 2.2.3 - Missing Access Control in deleteCustomType function