CVE-2024-6494: WordPress File Upload < 4.24.8 - Unauthenticated Stored XSS
Published Aug 7, 2024
·Updated
The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthenticated users to execute stored cross-site scripting (XSS) attacks.
Affected Software
1 affected component
WordPress File Upload<4.24.8
Event History
Aug 7, 2024
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:16 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2024-6494?
CVE-2024-6494 has a high severity due to its potential for storing cross-site scripting (XSS) attacks.
2
How do I fix CVE-2024-6494?
To fix CVE-2024-6494, update the WordPress File Upload plugin to version 4.24.8 or later.
3
Who is affected by CVE-2024-6494?
Any user of the WordPress File Upload plugin prior to version 4.24.8 is affected by CVE-2024-6494.
4
Can unauthenticated users exploit CVE-2024-6494?
Yes, unauthenticated users can exploit CVE-2024-6494 to execute stored cross-site scripting attacks.
5
What parameters are improperly sanitized in CVE-2024-6494?
CVE-2024-6494 involves certain parameters in the WordPress File Upload plugin that are not properly sanitized and escaped.