Wordpress File Upload
CVE-2023-4811
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.
AnalysisAI
The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks. Affected products include: Iptanus Wordpress File Upload. Version information: before 4.23.3.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Wordpress File Upload
View allThe WordPress File Upload plugin through version 4.24.15 contains critical vulnerabilities in wfu_file_downloader.php en
The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.2
An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. Rated critical severity (CVSS 9.8), this
The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and includi
The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which
The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a parameter before outputting it b
The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS. Rate
The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes. Rated medium severi
SQL injection in the WordPress File Upload plugin (by nickboss) affects all versions up to and including 5.1.7 and is re
The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.2
Cross-site request forgery (CSRF) vulnerability in the WordPress File Upload plugin (wp-file-upload) before 2.4.2 for Wo
The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s
Share
External POC / Exploit Code
Leaving vuln.today