CVE-2021-24563: The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScrip...

Summary

The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
frontend_uploader_project	frontend_uploader	<= 1.3.2 `cpe:2.3:a:frontend_uploader_project:frontend_uploader::::::wordpress::*`

Original advisory text

The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScrip...

The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly

References

http://packetstormsecurity.com/files/165515/WordPress-Frontend-Uploader-1.3.2-Cr... Exploit Third Party Advisory VDB Entry
https://wpscan.com/vulnerability/e53ef41e-a176-4d00-916a-3a03835370f1 Exploit Third Party Advisory