CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37254 – WordPress WP File Manager plugin <= 7.2.7 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2024-37254
Missing Authorization vulnerability in mndpsingh287 File Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects File Manager: from n/a through 7.2.7. The File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mk_file_manager_backup_callback function in versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger backups • https://patchstack.com/database/vulnerability/wp-file-manager/wordpress-wp-file-manager-plugin-7-2-7-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-33697 – WordPress CF7 File Download plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-33697
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rimes Gold CF7 File Download – File Download for CF7 allows Stored XSS.This issue affects CF7 File Download – File Download for CF7: from n/a through 2.0. Vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web ('cross-site Scripting') en Rimes Gold CF7 File Download – File Download for CF7 permite almacenar XSS. Este problema afecta la descarga de archivos CF7: descarga de archivos para CF7: desde n/a hasta 2.0 . The CF7 File Download – File Download for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/cf7-file-download/wordpress-cf7-file-download-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-32539 – WordPress WP File Download Light plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-32539
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP File Download Light allows Stored XSS.This issue affects WP File Download Light: from n/a through 1.3.3. La vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web ('Cross-site Scripting') en JoomUnited WP File Download Light permite almacenar XSS. Este problema afecta a WP File Download Light: desde n/a hasta 1.3.3. The WP File Download Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/wp-file-download-light/wordpress-wp-file-download-light-plugin-1-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.9EPSS: 0%CPEs: 2EXPL: 0CVE-2023-6825 – File Manager And File Manager Pro (Multiple Versions) - Directory Traversal
https://notcve.org/view.php?id=CVE-2023-6825
The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7.2.1 (free version) and 8.3.4 (Pro version) via the target parameter in the mk_file_folder_manager_action_callback_shortcode function. This makes it possible for attackers to read the contents of arbitrary files on the server, which can contain sensitive information and to upload files into directories other than the intended directory for file uploads. The free version requires Administrator access for this vulnerability to be exploitable. The Pro version allows a file manager to be embedded via a shortcode and also allows admins to grant file handling privileges to other user levels, which could lead to this vulnerability being exploited by lower-level users. Los complementos File Manager y File Manager Pro para WordPress son vulnerables a Directory Traversal en versiones hasta la versión 7.2.1 (versión gratuita) y 8.3.4 (versión Pro) incluida a través del parámetro de destino en la función mk_file_folder_manager_action_callback_shortcode. • https://github.com/Studio-42/elFinder/blob/master/php/elFinderVolumeDriver.class.php#L6784 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3023403%40wp-file-manager%2Ftrunk&old=2984933%40wp-file-manager%2Ftrunk&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/93f377a1-2c33-4dd7-8fd6-190d9148e804?source=cve • CWE-23: Relative Path Traversal •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-7015 – File Manager Pro <= 8.3.4 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2023-7015
The File Manager Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tb' parameter in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. El complemento File Manager Pro para WordPress es vulnerable a Cross-Site Scripting Reflejado a través del parámetro 'tb' en todas las versiones hasta la 8.3.4 incluida debido a una sanitización de entrada y un escape de salida insuficientes. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en páginas que se ejecutan si logran engañar a un usuario para que realice una acción como hacer clic en un enlace. • https://filemanagerpro.io/changelog https://www.wordfence.com/threat-intel/vulnerabilities/id/94750424-bb52-4236-962e-aa8cbdeb1459?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •