Not rated
CVE-2022-3137 The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any…
Description
The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (such as subscriber) creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Taskbuilder – WordPress Project & Task Management plugin 1.0 | earliest → < 1.0.8 | 1.0.8 |