Wordpress File Upload
CVE-2024-6494
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (wpscan) · only source for this CVE.
CVSS VectorVendor: wpscan
Lifecycle Timeline
1DescriptionCVE.org
The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthenticated users to execute stored cross-site scripting (XSS) attacks.
AnalysisAI
The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthenticated users to execute stored cross-site scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthenticated users to execute stored cross-site scripting (XSS) attacks. Affected products include: Iptanus Wordpress File Upload. Version information: before 4.24.8.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
More in Wordpress File Upload
View allThe WordPress File Upload plugin through version 4.24.15 contains critical vulnerabilities in wfu_file_downloader.php en
The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.2
An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. Rated critical severity (CVSS 9.8), this
The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and includi
The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a parameter before outputting it b
The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS. Rate
The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could
The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes. Rated medium severi
SQL injection in the WordPress File Upload plugin (by nickboss) affects all versions up to and including 5.1.7 and is re
The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.2
Cross-site request forgery (CSRF) vulnerability in the WordPress File Upload plugin (wp-file-upload) before 2.4.2 for Wo
The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today