Stored Cross-Site Scripting Vulnerability in WordPress File Upload Plugin

CVE-2024-2847

What is CVE-2024-2847?

The File Upload plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate input validation and insufficient output encoding of user-supplied attributes in its shortcode functionality. Authenticated users with contributor-level access or higher can exploit this vulnerability to embed malicious scripts into web pages, which will execute when other users view the affected pages, potentially compromising user data and website integrity. This issue affects all versions up to and including 4.24.5.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References