CVE-2023-2767: XSS
First published: Fri Jun 09 2023(Updated: )
The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.19.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Iptanus WordPress File Upload | <=4.19.1 | |
| Iptanus WordPress File Upload | <=4.19.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this WordPress plugin vulnerability?
The vulnerability ID for this WordPress plugin vulnerability is CVE-2023-2767.
What is the severity of CVE-2023-2767?
The severity of CVE-2023-2767 is medium.
Which plugins are affected by CVE-2023-2767?
The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are affected by CVE-2023-2767.
How can an attacker exploit CVE-2023-2767?
Authenticated attackers can exploit CVE-2023-2767 by using stored cross-site scripting via admin settings.
Are there any references for CVE-2023-2767?
Yes, you can find references for CVE-2023-2767 at the following links: [Link 1](https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2915978%40wp-file-upload%2Ftrunk&old=2909107%40wp-file-upload%2Ftrunk&sfp_email=&sfph_mail=#file2), [Link 2](https://www.wordfence.com/threat-intel/vulnerabilities/id/23334d94-e5b8-4c88-8765-02ad19e17248?source=cve).
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/remedy
- agent/severity
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/iptanus
- canonical/iptanus wordpress file upload
- version/iptanus wordpress file upload/4.19.1