CVE-2021-24563

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownFrontend Uploader>= 1.3.2, <= 1.3.2

References

Timeline

Published
Oct 11, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-245645.4The WPFront Scroll Top WordPress plugin before 2.0.6.07225 does not sanitise or escape its Image ALT setting before outputting it attributesCVE-2021-245658.8The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker tCVE-2021-245668.8The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode.CVE-2021-245675.4The Simple Post WordPress plugin through 1.1 does not sanitize user input when an authenticated user Text value, then it does not escape theCVE-2021-245685.4The AddToAny Share Buttons WordPress plugin before 1.7.46 does not sanitise its Sharing Header setting when outputting it in frontend pages,CVE-2021-245694.8The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.1.2 does not escape the value of its Button Text setting when outpuCVE-2021-24575.3Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Request Management & Workflow). The supported version CVE-2021-245704.3The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. TheCVE-2021-245715.4The HD Quiz WordPress plugin before 1.8.4 does not escape some of its Answers before outputting them in attribute when generating the Quiz, CVE-2021-245724.3The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored asCVE-2021-245744.8The Simple Banner WordPress plugin before 2.10.4 does not sanitise and escape one of its settings, allowing high privilege users such as admCVE-2021-245758.8The School Management System – WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before usi
CVE-2021-24563: Medium severity, CVSS 6.1 | Vulnix