Stored Cross-Site Scripting in Frontend File Upload Plugin for WordPress

CVE-2024-13504

What is CVE-2024-13504?

The Frontend File Upload Form & Secure File Sharing plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting (XSS) attacks. This occurs through dfxp file uploads due to inadequate input sanitization and output escaping. Attackers can exploit this flaw to inject malicious web scripts that execute whenever a user accesses the tainted dfxp file. It is important to note that this issue predominantly affects installations in Apache-based environments, where dfxp file handling is configured by default.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References