Medium severity · published Aug 16, 2024
CVE-2024-7301
WordPress File Upload <= 4.24.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
6.1
CVSS
0.5%
EPSS
No
On KEV
Description
The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.24.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IF
Iptanus File Upload · nickboss
through 4.24.8 · source: vendor
WF
Wordpress File Upload · Iptanus
before 4.24.9 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7301
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7301
Product
https://plugins.trac.wordpress.org/browser/wp-file-upload/tags/4.24.8/lib/wfu_io.php#L176
Product
https://plugins.trac.wordpress.org/browser/wp-file-upload/tags/4.24.8/lib/wfu_security.php#L50
Patch
https://plugins.trac.wordpress.org/changeset/3136025/
Product
https://wordpress.org/plugins/wp-file-upload/#developers
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/e2b16b9c-48c7-4370-839b-696797ff2101?source=cve
More from Iptanus File Upload
9.8
CVE-2024-11635
WordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Execution
9.8
CVE-2024-11613
WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion
9.8
CVE-2024-9047
WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php
7.5
CVE-2024-9939
WordPress File Upload <= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php
5.4
CVE-2024-2847
WordPress File Upload <= 4.24.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode