CVE-2021-23562

The plupload file upload API (versions prior to 2.3.9 ) is vulnerable to a code injection flaw. An attacker can upload a file with a name containing JavaScript code , which can then be executed by the browser. Exploitation requires the attacker to trick a user into uploading such a file. No speci...