Lucene search
DmitriyWPVDB-ID:16375A7F-0A9F-4961-8510-D047FFBF3954HistoryAug 02, 2023 - 12:00 a.m.
Upload Media By URL < 1.0.8 - Stored XSS via CSRF
2023-08-0200:00:00
Dmitriy
wpscan.com
1
csrf
file upload
admin
security flaw
unfiltered html
EPSS
0.001
Percentile
30.6%
Description The plugin does not have CSRF check when uploading files, which could allow attackers to make logged in admins upload files (including HTML containing JS code for users with the unfiltered_html capability) on their behalf.
PoC
Have a logged in user with the unfiltered_html capability open an HTML file containing the following (this will make them upload the xss.html file):
Related
cvelist
cvelist
CVE-2023-3720 Upload Media By URL < 1.0.8 - Stored XSS via CSRF
2023-08-30 14:22:00
cve
cve
CVE-2023-3720
2023-08-30 15:15:09
prion
prion
Cross site request forgery (csrf)
2023-08-30 15:15:00
wpexploit
wpexploit
Upload Media By URL < 1.0.8 - Stored XSS via CSRF
2023-08-02 00:00:00
nvd
nvd
CVE-2023-3720
2023-08-30 15:15:09
wordfence
wordfence