CVE-2021-34626

A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions added by administrators. This issue affects versions 2.2.3 and prior...

CVE-2021-34626

A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions added by administrators. This issue affects versions 2.2.3 and prior...

CVE-2021-34627

A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extensions added by administrators. This issue affects versions 2.2.3 and prior...

CVE-2021-34625

A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scripts. This issue affects versions 2.2.3 and prior...

Design/Logic Flaw

A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scripts. This issue affects versions 2.2.3 and prior...

CVE-2021-34625 WP Upload Restriction <= 2.2.3 - Authenticated Stored Cross-Site Scripting

A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scripts. This issue affects versions 2.2.3 and prior...

CVE-2021-34625

The CVE-2021-34625 issue affects the WordPress WP Upload Restriction plugin (versions

CVE-2021-34627 WP Upload Restriction <= 2.2.3 - Missing Access Control in getSelectedMimeTypesByRole function

A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extensions added by administrators. This issue affects versions 2.2.3 and prior...

CVE-2021-34627

The CVE refers to WP Upload Restriction WordPress plugin vulnerability in getSelectedMimeTypesByRole, affecting versions 2.2.3 and earlier. The issue allows a low‑level authenticated user to view custom extensions added by administrators, indicating an access‑control weakness in the role/ mime-ty...

CVE-2021-34626 WP Upload Restriction <= 2.2.3 - Missing Access Control in deleteCustomType function

A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions added by administrators. This issue affects versions 2.2.3 and prior...

CVE-2021-34626

The CVE-2021-34626 issue affects the WordPress plugin WP Upload Restriction , specifically versions 2.2.3 and prior . The root cause is a missing access control in the deleteCustomType function, allowing low‑level authenticated users to delete custom extensions added by administrators. Documented...

WordPress plugin WP Upload Restriction 安全漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An access control error vulnerability exists in WordPress plugin WP Upload Restriction 2.2.3 and...

WP Upload Restriction <= 2.2.3 - Authenticated Stored XSS

Missing Access Control in the saveCustomType function allows for authenticated users, such as subscribers, to add mime types and extensions through unsanitized parameters that makes it possible to inject malicious web scripts that later execute when an administrator visits the extensions page...

PT-2021-20593 · WordPress · Wp Upload Restriction

Name of the Vulnerable Software and Affected Versions: WP Upload Restriction WordPress plugin versions 2.2.3 and prior Description: A vulnerability in the deleteCustomType function allows low-level authenticated users to delete custom extensions added by administrators. Recommendations: For...

WordPress WP Upload Restriction plugin <= 2.2.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Angelo Righi in WordPress WP Upload Restriction plugin versions = 2.2.3. Solution Update the WordPress WP Upload Restriction plugin to the latest available version at least 2.2.4...

WordPress WP Upload Restriction plugin <= 2.2.3 - Missing Access Control in deleteCustomType function vulnerability

Missing Access Control in deleteCustomType function vulnerability discovered in WordPress WP Upload Restriction plugin versions = 2.2.3. Solution Update the WordPress WP Upload Restriction plugin to the latest available version at least 2.2.5...

WordPress WP Upload Restriction plugin <= 2.2.3 - Missing Access Control in getSelectedMimeTypesByRole function vulnerability

Missing Access Control in getSelectedMimeTypesByRole function vulnerability discovered in WordPress WP Upload Restriction plugin versions = 2.2.3. Solution Update the WordPress WP Upload Restriction plugin to the latest available version at least 2.2.5...

WordPress 安全漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An access control error vulnerability exists in WordPress WP Upload Restriction plugin 2.2.3 and pri...

PT-2021-20594 · WordPress · Wp Upload Restriction

Name of the Vulnerable Software and Affected Versions: WP Upload Restriction WordPress plugin versions 2.2.3 and prior Description: A vulnerability in the getSelectedMimeTypesByRole function allows low-level authenticated users to view custom extensions added by administrators. Recommendations: F...

CVE-2021-24386

The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ to upload a malicious SVG and then perform XSS attacks by inducing another user to access the file directly. In v3.4, the plugin restricted such upload to...