WordPress File Upload Plugin < 4.24.8 - Cross-Site Scripting
The WordPress File Upload plugin before version 4.24.8 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the 'dir' parameter in the file browser page before outputting it back, which could allow attackers to execute arbitrary JavaScript code in an administrator's browser context.
wp-file-uploadPoC 已收录
CVSS7.1EPSS 6.5%