CVE-2021-24960

CVE-2021-24960: WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVG

Vendor Unknown

Product WordPress File Upload

Weakness CWE-434 · Unrestricted file upload

Published March 7, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks

Key dates

02Disclosure timeline

March 7, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-24960 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Identifiers

CVE CVE-2021-24960

CWE CWE-434

Affected versions

Vendor Unknown

Product WordPress File Upload

Affected ≥ 4.16.3 and < 4.16.3

Vendor Unknown

Product wordpress-file-upload-pro

Affected ≥ 4.16.3 and < 4.16.3