PT-2026-103030 · WordPress · All In One Files Upload
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
All in One Files Upload WordPress plugin versions prior to 2.0.17
Description
The plugin allows unauthenticated users to upload files containing active content because it adds SVG to the allowed upload types without sanitizing the files or verifying the authenticity of public upload requests. This allows the uploaded content to execute within the site's origin when accessed by a victim.
Recommendations
Update All in One Files Upload WordPress plugin to version 2.0.17 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
All In One Files Upload