Wordpress File Upload vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

WF

Product

Wordpress File Upload

by Iptanus · last CVE Feb 25, 2025

25

CVEs

0

On KEV

9.8

Max CVSS

0

New 30D

Vulnerabilities25 In the news0 Timeline

Severity mix

Critical 4High 6Medium 14Low 1

Severity

All severities25 Critical4 High6 Medium14 Low1

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Wordpress File Upload to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-7301	6.1	0%	Aug 16	WordPress File Upload <= 4.24.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload Affected: before 4.24.9
CVE-2024-6494	6.1	0%	Aug 7	WordPress File Upload < 4.24.8 - Unauthenticated Stored XSS Affected: before 4.24.8
CVE-2024-6651	6.1	16%	Aug 6	WordPress File Upload < 4.24.8 - Reflected XSS Affected: before 4.24.8
CVE-2018-9844	6.1	4%	Apr 7	The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS Affected: before 4.3.4
CVE-2023-2767	5.5	0%	Jun 9	WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Stored Cross-Site Scripting Affected: through 4.19.1
CVE-2024-2847	5.4	0%	Apr 9	WordPress File Upload <= 4.24.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Affected: before 4.24.6
CVE-2023-4811	5.4	0%	Oct 16	WordPress File Upload < 4.23.3 - Author+ Stored Cross-Site Scripting Affected: before 4.23.3
CVE-2021-24961	5.4	1%	Mar 7	WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Shortcode Affected: before 4.16.3
CVE-2021-24960	5.4	1%	Mar 7	WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVG Affected: before 4.16.3
CVE-2018-9172	5.4	3%	Apr 1	The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes Affected: before 4.3.3
CVE-2023-2688	4.9	2%	Jun 9	WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Path Traversal Affected: through 4.19.1
CVE-2024-13494	4.3	0%	Feb 25	WordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_details Affected: before 4.25.3
CVE-2024-12719	4.3	0%	Jan 7	WordPress File Upload <= 4.24.15 - Missing Authorization to Authenticated (Subscriber+) Limited Path Traversal Affected: before 4.25.0
CVE-2024-5852	4.3	1%	Jul 16	WordPress File Upload <= 4.24.7 - Authenticated (Contributor+) Directory Traversal Affected: before 4.24.8