CVE-2021-24960

The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.78% chance of exploitation in the next 30 days, 53th percentile

Published

2022-03-07

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/18902832-2973-498d-808e-c75d1aedc11e

References

• CVE Record
• NVD entry

Related

• CVE-2021-24959
• CVE-2021-24961
• CVE-2021-24958
• CVE-2021-24962
• CVE-2021-24957
• CVE-2021-24963