D3Dc0D

An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions.

A Path Traversal issue exists due to missing ownership validation on attachment IDs provided via the media-field upload preset JSON. This allows authenticated users with subscriber-level access and above to reference attachments they did not upload. By supplying a manipulated attachment ID, an attacker can trigger the media cleanup routine to treat the file as a prior upload belonging to the current submission, resulting in the deletion of arbitrary media attachments.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages, which execute when a user accesses the affected page.