Description

WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.

Remediation

References

CVE-2019-16217

Related Vulnerabilities

WordPress Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVE-2020-4050)

SharePoint Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-1892)

WordPress Plugin Social Media Tab Remote Code Execution (1.0.9)

WordPress Plugin Google XML Sitemaps Cross-Site Scripting (4.0.8)

MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2021-31549)

Severity

Medium

Classification

CVE-2019-16217 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities