Vanquish Woocommerce Upload Files vulnerabilities
2 known vulnerabilities affecting vanquish/woocommerce_upload_files.
Total CVEs
2
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL2
Vulnerabilities
Page 1 of 1
CVE-2024-10820P2CRITICALCVSS 9.8fixed in 84.42024-11-13
CVE-2024-10820 [CRITICAL] CWE-434 CVE-2024-10820: The WooCommerce Upload Files plugin for WordPress is vulnerable to arbitrary file uploads due to mis
The WooCommerce Upload Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in all versions up to, and including, 84.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution po
nvd
CVE-2021-24171P3CRITICALCVSS 9.8fixed in 59.42021-04-05
CVE-2021-24171 [CRITICAL] CWE-434 CVE-2021-24171: The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove b
The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass this and upload a file with a PHP extension by embedding a "blocked" extension within another "blocked" extension in the "wcuf_file_name" parameter. It was also possible to perform a double e
nvd