WordPress File Upload < 4.24.8 – Unauthenticated Stored XSS | CVE 2024-6494 | Plugin Vulnerabilities

Description

The plugin does not properly sanitize and escape certain parameters, which could allow unauthenticated users to execute stored cross-site scripting (XSS) attacks.

Proof of Concept

- Add the upload form to an existing page/post 
- Add a custom field (e.g., simple text) to submit additional data along with the uploaded file
- Submit the form as an unauthenticated user with the following payload in the text field
Message" style=animation-name:rotation onanimationstart=alert(/XSS/)//
- As an admin, go to the "Uploaded Files" section and click on "View details" to trigger the XSS

Affects Plugins

Fixed in 4.24.8

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Majdeddine Ben Hadj Brahim

Submitter

Majdeddine Ben Hadj Brahim

Verified

Yes

WPVDB ID

5b21a9be-b5fe-47ef-91c7-018dd42f763f

Timeline

Publicly Published

2024-07-16 (about 1 year ago)

Added

2024-07-16 (about 1 year ago)

Last Updated

2024-07-16 (about 1 year ago)

Other

Published

Title

Published

2015-04-16

Title

Content Slide <= 1.4.2 - CSRF & Stored XSS

Published

2023-01-20

Title

MailOptin 1.2.54.0 - Admin+ Stored XSS

Published

2022-03-01

Title

Bank Mellat < 2.0.1 - Reflected Cross-Site Scripting

Published

2023-04-04

Title

Quick Paypal Payments < 5.7.26.4 - Admin+ Stored XSS

Published

2024-02-28

Title

WP Social Widget < 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode