Stored Cross-Site Scripting Vulnerability in FileBird Plugin for WordPress

CVE-2024-2345

Summary

The FileBird plugin for WordPress is susceptible to stored cross-site scripting due to insufficient input validation and output sanitization when handling the folder name parameter. This vulnerability enables authenticated attackers, who have author-level permissions or higher, to inject arbitrary scripts into folder names that execute whenever any user accesses a page with an injected folder name. This poses significant security risks, as it compromises the integrity of web pages viewed by users. It’s crucial for site administrators to update to secure versions and adopt best practices in input validation to mitigate risks associated with this vulnerability.

References