Animate It! < 2.4.0 - Contributor+ Stored Cross-Site Scripting

The plugin has flawed validations and does not escape its shortcode argument, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks via a malicious shortcode PoC v 2.3.8 edsanimate animation="attacker" delay='1"...

CVE-2021-24962: Improper Limitation of a Pathname to a Restricted Directory

The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode argument, which can then be used to upload a PHP code disguised as an image inside the auto-loaded directory of the plugin, resulting in...

CVE-2021-24961: Improper Neutralization of Input During Web Page Generation

The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 does not escape some of its shortcode argument, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...