CVE-2023-2767: WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.19.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfilteredhtml has been disabled.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this WordPress plugin vulnerability?
The vulnerability ID for this WordPress plugin vulnerability is CVE-2023-2767.
What is the severity of CVE-2023-2767?
The severity of CVE-2023-2767 is medium.
Which plugins are affected by CVE-2023-2767?
The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are affected by CVE-2023-2767.
How can an attacker exploit CVE-2023-2767?
Authenticated attackers can exploit CVE-2023-2767 by using stored cross-site scripting via admin settings.
Are there any references for CVE-2023-2767?
Yes, you can find references for CVE-2023-2767 at the following links: [Link 1](https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2915978%40wp-file-upload%2Ftrunk&old=2909107%40wp-file-upload%2Ftrunk&sfp_email=&sfph_mail=#file2), [Link 2](https://www.wordfence.com/threat-intel/vulnerabilities/id/23334d94-e5b8-4c88-8765-02ad19e17248?source=cve).