Stored Cross-Site Scripting Vulnerability in User Private Files Plugin for WordPress

CVE-2024-13799

What is CVE-2024-13799?

The User Private Files – File Upload & Download Manager with Secure File Sharing plugin for WordPress has a vulnerability that allows authenticated users with Subscriber-level access or higher to execute arbitrary web scripts through the 'new-fldr-name' parameter. This is due to inadequate input sanitization and output escaping, which can lead to the injection of malicious scripts into pages. Users accessing these pages may inadvertently execute harmful scripts, posing significant security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References