What the vulnerability does
01Description
A vulnerability has been found in wp-file-upload Plugin up to 2.4.3 on WordPress and classified as problematic. Affected by this vulnerability is the function wfu_ajax_action_callback of the file lib/wfu_ajaxactions.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.4.4 is able to address this issue. The identifier of the patch is c846327df030a0a97da036a2f07c769ab9284ddb. It is recommended to upgrade the affected component. The identifier VDB-258781 was assigned to this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
The wp-file-upload plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into the site. An attacker with low-level access can craft input that executes in other users' browsers when they view affected content. This requires user interaction to trigger the payload.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that execute in other users' browsers when they view the affected page.
Potential impact on your site
04Site Impact
Authenticated users can inject scripts that compromise other users' sessions or steal their data when they view affected content.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account on the site and the victim must view the page containing the injected payload.
Key dates
06Disclosure timeline
March 31, 2024
CVE published
August 6, 2024
Record updated
