Skip to content
OpenAdvisories

Vendor

Nickboss

15 known vulnerabilities.

Products

Iptanus File Upload 11 WordPress File Upload 4
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 4.3
    CVE-2024-13494

    WordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_details

    The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. This is due to missing or incorrect nonce validation on the 'wfu_file_details' function. This makes it possible for unauth…

    Nickboss Iptanus File Upload Web / CMS
  • Medium 4.3
    CVE-2024-12719

    WordPress File Upload <= 4.24.15 - Missing Authorization to Authenticated (Subscriber+) Limited Path Traversal

    The WordPress File Upload plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wfu_ajax_action_read_subfolders' function in all versions up to, and including, 4.24.15. This makes it possible for authentic…

    Nickboss Iptanus File Upload Web / CMS
  • Medium 4.3
    CVE-2024-5852

    WordPress File Upload <= 4.24.7 - Authenticated (Contributor+) Directory Traversal

    The WordPress File Upload plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.24.7 via the 'uploadpath' parameter of the wordpress_file_upload shortcode. This makes it possible for authenticated attackers, with Co…

    Nickboss Iptanus File Upload Web / CMS
  • Medium 6.4
    CVE-2024-2847

    WordPress File Upload <= 4.24.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.24.5 due to insufficient input sanitization and output escaping on user supplied attributes. This…

    Nickboss Iptanus File Upload Web / CMS
  • Medium 4.9
    CVE-2023-2688

    WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Path Traversal

    The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versions up to, and including, 4.19.1 via the vulnerable parameter wfu_newpath. This allows administrator-level attackers to move files uploaded …

    Nickboss Iptanus File Upload Web / CMS
  • Medium 4.4
    CVE-2023-2767

    WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

    The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.19.1 due to insufficient input sanitization and output escaping. This makes it p…

    Nickboss Iptanus File Upload Web / CMS