Published: 05/09/2023 Updated: 07/11/2023

CVSS v3 Base Score: 4.8 | Impact Score: 2.7 | Exploitability Score: 1.7

VMScore: 0

The WordPress File Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Vulnerable Product	Search on Vulmon	Subscribe to Product
userprivatefiles wordpress file sharing plugin

Unauthenticated Remote Code Execution with default Imagick

CVE-2023-4636 The vulnerability in the limelight is an unauthenticated remote code execution (RCE) issue stemming from insufficient controls on file paths occurring during image processing via Imagick It enables adversaries to supply files via FTP, leading to local file inclusion and remote code execution Under these conditions, an attacker could potentially take over any un

https://www.wordfence.com/threat-intel/vulnerabilities/id/1df04293-87e9-4ab4-975d-54d36a993ab0?source=cve https://plugins.trac.wordpress.org/changeset/2961909/user-private-files https://github.com/xsn1210/vul2/blob/main/xss%5BWordPressFile%5D%20.md https://nvd.nist.gov https://github.com/ThatNotEasy/CVE-2023-4636

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2023-4636

Vulnerability Summary

Github Repositories

References

Vulmon Search

About

Products

Connect