Frontend Uploader <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting

Summary

The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly

Timeline

1. Oct 11, 2021, 10:45 AM UTCCVE published
2. Jan 12, 2022Public exploit on Exploit-DB

   EDB-50655

3. Aug 3, 2024, 7:35 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Unknown Frontend Uploader

  From 1.3.2 · through 1.3.2

References 4