Cross-site request forgery (CSRF) vulnerability in the WordPress File Upload plugin (wp-file-upload) before 2.4.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. NOTE: some of these details are ob...
7.4AI Score
0.001EPSS
The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.
7.5CVSS
7.7AI Score
0.001EPSS
The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.
7.5CVSS
7.7AI Score
0.001EPSS
The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files.
7.5CVSS
7.7AI Score
0.001EPSS
The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.
7.5CVSS
7.6AI Score
0.001EPSS
The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes.
5.4CVSS
5.5AI Score
0.002EPSS
The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS.
6.1CVSS
6.2AI Score
0.001EPSS
An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote code execution by uploading a crafted txt file into the lib directory, because of a wfu_include_lib call.
9.8CVSS
9.6AI Score
0.053EPSS
The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks
5.4CVSS
5.3AI Score
0.001EPSS
The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 does not escape some of its shortcode argument, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
5.4CVSS
5.2AI Score
0.001EPSS
The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode argument, which can then be used to upload a PHP code disguised as an image inside the auto-loaded directory of the plugin, resulting in arb...
8.8CVSS
8.9AI Score
0.001EPSS
The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versions up to, and including, 4.19.1 via the vulnerable parameter wfu_newpath. This allows administrator-level attackers to move files uploaded with the plugin (located in wp-content/u...
4.9CVSS
5.5AI Score
0.001EPSS
The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.19.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...
5.5CVSS
5.3AI Score
0.001EPSS
The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.
5.4CVSS
5.1AI Score
0.0004EPSS