Stored Cross-Site Scripting Vulnerability in WordPress File Upload Plugin

CVE-2024-2847

What is CVE-2024-2847?

The File Upload plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate input validation and insufficient output encoding of user-supplied attributes in its shortcode functionality. Authenticated users with contributor-level access or higher can exploit this vulnerability to embed malicious scripts into web pages, which will execute when other users view the affected pages, potentially compromising user data and website integrity. This issue affects all versions up to and including 4.24.5.

References