6.1
Medium
CVE-2024-6494 The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which…
Description
The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthenticated users to execute stored cross-site scripting (XSS) attacks.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WordPress File Upload 4.24 | earliest → < 4.24.8 | 4.24.8 |
| wordpress_file_upload 4.24 | earliest → < 4.24.8 | 4.24.8 |
Other CVEs of WordPress File Upload
The 6 CVEs of WordPress File Upload →
CVE-2024-6651
The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a parameter before outputting it…
6.1
Medium
CVE-2023-4811
The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which…
5.4
Medium
CVE-2021-24962
The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor…
Not rated
CVE-2021-24961
The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3…
Not rated