AdSanity < 1.8.2 - Contributor Arbitrary File Upload

Description

The plugin does not have authorisation check in its adsanity_html5_upload, relying on a CSRF check for it. However, the nonce is available to any authenticated with a role as low contributor, allowing them to call it. Furthermore, due to the lack of validation of the upload file, it could allow them to upload arbitrary PHP and HTML files, leading to RCE and XSS.

Note: v1.8.2 does not allow contributor to perform such attack anymore, however Author+ can still do it.