CVE-2021-24960: WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVG
The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-24960.
What is the severity of CVE-2021-24960?
The severity of CVE-2021-24960 is medium with a CVSS score of 5.4.
Which plugins are affected by CVE-2021-24960?
The WordPress File Upload WordPress plugin and the WordPress File Upload Pro plugin before version 4.16.3 are affected by CVE-2021-24960.
What is the impact of CVE-2021-24960?
CVE-2021-24960 allows users with low privilege roles to configure the upload form in a way that allows uploading of SVG files, which could be used for Cross-Site Scripting (XSS) attacks.
Are there any references or additional information available for CVE-2021-24960?
Yes, you can find more information about CVE-2021-24960 at the following references: [1](https://plugins.trac.wordpress.org/changeset/2677722) and [2](https://wpscan.com/vulnerability/18902832-2973-498d-808e-c75d1aedc11e).