File Away <= 3.9.9.0.1 - Contributor+ Stored XSS via Shortcode
published June 12, 2023
CVSS
—
EPSS
0%
Percentile
29.8
In the wild
Unconfirmed
What it is
The File Away WordPress plugin through 3.9.9.0.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00370 · 29.8th percentile
Published
2023-06-12T17:28Z
EPSS history
Timeline
12 JUN 17:28Z
File Away <= 3.9.9.0.1 - Contributor+ Stored XSS via Shortcode