WordPress Authenticated JavaScript File Upload

OWASP 2013-A9 OWASP 2017-A9 OWASP 2021-A6 PCI v3.2-6.5.1 CWE-434 WSTG-INFO-08

The old versions of WordPress are vulnerable to cross-site scripting attacks. The old WordPress does not require the unfiltered_html capability to upload the javascript files. This vulnerability could allow attackers to execute Cross-site Scripting attacks using a crafted vulnerable file. Cross-site Scripting (XSS) is a client-side code injection attack where, an attacker can execute malicious scripts into a website or web application. This flaw can cause attackers to access any cookies, session tokens, or other sensitive information retained by the client side.

Impact and Fixes

Latest Articles