deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-47585
Published: 2025-06-02
Description: Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booking and Rental Manager: from n/a through <= 2.3.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/booking-and-rental-manager-for-woocommerce/vulnerability/wordpress-booking-and-rental-manager-2-3-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48387
Published: 2025-06-02
Description: tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.
CWE: CWE-22
References: https://github.com/google/security-research/security/advisories/GHSA-xrg4-qp5w-2c3w; https://github.com/mafintosh/tar-fs/commit/647447b572bc135c41035e82ca7b894f02b17f0f; https://github.com/mafintosh/tar-fs/security/advisories/GHSA-8cj5-5rvv-wf4v
CVE: CVE-2025-48996
Published: 2025-06-02
Description: HAX open-apis provides microservice apis for HAX webcomponents repo that are shared infrastructure calls. An unauthenticated information disclosure vulnerability exists in the Penn State University deployment of the HAX content management system via the `haxPsuUsage` API endpoint, related to a flat present in open-apis versions up to and including 10.0.2. This allows any remote unauthenticated user to retrieve a full list of PSU websites hosted on HAX CMS. When chained with other authorization issues (e.g., HAX-3), this could assist in targeted attacks such as unauthorized content modification or deletion. Commit 06c2e1fbb7131a8fe66aa0600f38dcacae6b7ac7 patches the vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201
References: https://github.com/haxtheweb/issues/security/advisories/GHSA-fvx2-x7ff-fc56; https://github.com/haxtheweb/open-apis/commit/06c2e1fbb7131a8fe66aa0600f38dcacae6b7ac7
CVE: CVE-2025-3919
Published: 2025-06-02
Description: The WordPress Comments Import & Export plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings function in all versions up to, and including, 2.4.3. Additionally, the plugin fails to properly sanitize and escape FTP settings parameters. 
This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts on the plugin settings page that will execute whenever an administrative user accesses an injected page.
The vulnerability was partially fixed in version 2.4.3 and fully fixed in version 2.4.4
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/comments-import-export-woocommerce/trunk/includes/settings/class-hf_cmt_impexpcsv-settings.php?rev=3278076; https://plugins.trac.wordpress.org/changeset/3288894/; https://plugins.trac.wordpress.org/changeset/3301183/
CVE: CVE-2025-49162
Published: 2025-06-03
Description: Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow file overwrite via TFTP because a remote filename with a space character allows an attacker to control the local filename.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-424
References: https://full-disclosure.eu/reports/2025/FDEU-CVE-2025-1c00-arris-bootloader-shell-injection.html
CVE: CVE-2025-49163
Published: 2025-06-03
Description: Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image via a crafted /usr/bin/gunzip file.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-424
References: https://full-disclosure.eu/reports/2025/FDEU-CVE-2025-1c00-arris-bootloader-shell-injection.html
CVE: CVE-2025-49164
Published: 2025-06-03
Description: Arris VIP1113 devices through 2025-05-30 with KreaTV SDK have a firmware decryption key of cd1c2d78f2cba1f73ca7e697b4a485f49a8a7d0c8b0fdc9f51ced50f2530668a.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-321
References: https://full-disclosure.eu/reports/2025/FDEU-CVE-2025-1c00-arris-bootloader-shell-injection.html
CVE: CVE-2025-5068
Published: 2025-06-03
Description: Use after free in Blink in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/409059706
CVE: CVE-2025-5419
Published: 2025-06-03
Description: Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-787
References: https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/420636529; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-5419
CVE: CVE-2025-2939
Published: 2025-06-03
Description: The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.0.18 via deserialization of untrusted input from the args[callback] parameter . This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary functions, though it does not allow user supplied parameters only single functions can be called so the impact is limited.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/ninja-tables/tags/5.0.18/vendor/wpfluent/framework/src/WPFluent/Http/Client.php#L399; https://plugins.trac.wordpress.org/browser/ninja-tables/tags/5.0.19/vendor/wpfluent/framework/src/WPFluent/Http/Client.php#L399; https://plugins.trac.wordpress.org/browser/ninja-tables/trunk/vendor/wpfluent/framework/src/WPFluent/Http/Client.php#L399
CVE: CVE-2025-4047
Published: 2025-06-03
Description: The Broken Link Checker plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the ajax_full_status and ajax_dashboard_status functions in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view the plugin's status.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.2/legacy/core/core.php#L3272; https://plugins.trac.wordpress.org/changeset/3294992/; https://www.wordfence.com/threat-intel/vulnerabilities/id/33ac910c-9531-45ea-84cf-1d379233f7d3?source=cve
CVE: CVE-2025-4224
Published: 2025-06-03
Description: The wpForo + wpForo Advanced Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via media upload names in all versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://gvectors.com/product/wpforo-advanced-attachments/#tab-changelog; https://www.wordfence.com/threat-intel/vulnerabilities/id/e634dafc-8eb0-406f-93b1-ee1d2b44171d?source=cve
CVE: CVE-2025-4797
Published: 2025-06-03
Description: The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.7.0. This is due to the plugin not properly validating a user's identity prior to setting an authorization cookie. This makes it possible for unauthenticated attackers to log in as any user, including administrators, provided they know the user's email address. CVE-2025-54725 is likely a duplicate of this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://themeforest.net/item/golo-directory-listing-travel-wordpress-theme/25397810; https://www.wordfence.com/threat-intel/vulnerabilities/id/e7b56ec1-8735-4404-8069-219f5d8866d0?source=cve
CVE: CVE-2024-53010
Published: 2025-06-03
Description: Memory corruption may occur while attaching VM when the HLOS retains access to VM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html
CVE: CVE-2024-53013
Published: 2025-06-03
Description: Memory corruption may occur while processing voice call registration with user.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-120
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html
CVE: CVE-2024-53015
Published: 2025-06-03
Description: Memory corruption while processing IOCTL command to handle buffers associated with a session.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html
CVE: CVE-2024-53016
Published: 2025-06-03
Description: Memory corruption while processing I2C settings in Camera driver.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-367
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html
CVE: CVE-2024-53017
Published: 2025-06-03
Description: Memory corruption while handling test pattern generator IOCTL command.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-823
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html
CVE: CVE-2024-53018
Published: 2025-06-03
Description: Memory corruption may occur while processing the OIS packet parser.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-367
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html
CVE: CVE-2024-53019
Published: 2025-06-03
Description: Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources.
CVSS Score: 8.2 (HIGH)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html
CVE: CVE-2024-53020
Published: 2025-06-03
Description: Information disclosure may occur while decoding the RTP packet with invalid header extension from network.
CVSS Score: 8.2 (HIGH)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html
CVE: CVE-2024-53021
Published: 2025-06-03
Description: Information disclosure may occur while processing goodbye RTCP packet from network.
CVSS Score: 8.2 (HIGH)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html
CVE: CVE-2024-53026
Published: 2025-06-03
Description: Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.
CVSS Score: 8.2 (HIGH)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html
CVE: CVE-2025-21463
Published: 2025-06-03
Description: Transient DOS while processing the EHT operation IE in the received beacon frame.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html
CVE: CVE-2025-21480
Published: 2025-06-03
Description: Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
CVSS Score: 8.6 (HIGH)
CWE: CWE-863
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21480
CVE: CVE-2025-21485
Published: 2025-06-03
Description: Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html
CVE: CVE-2025-21486
Published: 2025-06-03
Description: Memory corruption during dynamic process creation call when client is only passing address and length of shell binary.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html
CVE: CVE-2025-27029
Published: 2025-06-03
Description: Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html
CVE: CVE-2025-27031
Published: 2025-06-03
Description: memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html
CVE: CVE-2025-27038
Published: 2025-06-03
Description: Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27038
CVE: CVE-2025-31710
Published: 2025-06-03
Description: In engineermode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-77
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]14909186
CVE: CVE-2025-31711
Published: 2025-06-03
Description: In cplog service, there is a possible system crash due to null pointer dereference. This could lead to local denial of service with no additional execution privileges needed.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-476
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]14909186
CVE: CVE-2025-31712
Published: 2025-06-03
Description: In cplog service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-120
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]14909186
CVE: CVE-2025-3584
Published: 2025-06-03
Description: The Newsletter  WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/76937bdd-7ffa-4b5e-ade1-60da095a03a3/; https://wpscan.com/vulnerability/76937bdd-7ffa-4b5e-ade1-60da095a03a3/
CVE: CVE-2025-3662
Published: 2025-06-03
Description: The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4cda12f0-3c23-44ad-80ea-db2443ebcf82/; https://wpscan.com/vulnerability/4cda12f0-3c23-44ad-80ea-db2443ebcf82/
CVE: CVE-2025-4567
Published: 2025-06-03
Description: The Post Slider and Post Carousel with Post Vertical Scrolling Widget  WordPress plugin before 3.2.10 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b8a50ae9-40c4-42f8-9342-2440d3bc12bb/; https://wpscan.com/vulnerability/b8a50ae9-40c4-42f8-9342-2440d3bc12bb/
CVE: CVE-2025-21479
Published: 2025-06-03
Description: Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
CVSS Score: 8.6 (HIGH)
CWE: CWE-863
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21479
CVE: CVE-2025-41428
Published: 2025-06-03
Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in TimeWorks 10.0 to 10.3. If exploited, arbitrary JSON files on the server may be viewed by a remote unauthenticated attacker.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN37075430/; https://www.keiyo-system.co.jp/archives/11310
CVE: CVE-2025-46355
Published: 2025-06-03
Description: Incorrect default permissions issue in PC Time Tracer prior to 5.2. If exploited, arbitrary code may be executed with SYSTEM privilege on Windows system where the product is running by a local authenticated attacker.
CVSS Score: 7.3 (HIGH)
CWE: CWE-276
References: https://jvn.jp/en/jp/JVN05562338/; https://www.keiyo-system.co.jp/archives/11305
CVE: CVE-2025-1725
Published: 2025-06-03
Description: The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/file-manager/tags/6.6.3/backend/app/Http/Controllers/FileManagerController.php#L112; https://www.wordfence.com/threat-intel/vulnerabilities/id/84ddb481-f989-4ba8-9925-e8327c30de38?source=cve
CVE: CVE-2025-4420
Published: 2025-06-03
Description: The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘containerWidth’ parameter in all versions up to, and including, 1.3.1 due to a missing capability check on the vayu_blocks_option_panel_callback() function and insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/vayu-blocks/trunk/inc/admin-api.php#L6; https://plugins.trac.wordpress.org/changeset/3303594/; https://wordpress.org/plugins/vayu-blocks/#developers
CVE: CVE-2025-5103
Published: 2025-06-03
Description: The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to boolean-based SQL Injection via the 'default_price' and 'product_id' parameters in all versions up to, and including, 3.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/woo-gift-cards-lite/tags/3.1.4/admin/class-woocommerce-gift-cards-lite-admin.php#L571; https://plugins.trac.wordpress.org/changeset/3303359/; https://wordpress.org/plugins/woo-gift-cards-lite/#developers
CVE: CVE-2025-5116
Published: 2025-06-03
Description: The WP Plugin Info Card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘containerid’ parameter in all versions up to, and including, 5.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This issue is due to an incomplete patch for CVE-2025-31835.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/DLXPlugins/wp-plugin-info-card/blob/dev/php/Shortcodes.php#L893; https://plugins.trac.wordpress.org/browser/wp-plugin-info-card/trunk/php/Shortcodes.php#L929; https://plugins.trac.wordpress.org/changeset/3303791
CVE: CVE-2024-36486
Published: 2025-06-03
Description: A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored, the prl_vmarchiver tool decompresses the file and writes the content back to its original location using root privileges. An attacker can exploit this process by using a hard link to write to an arbitrary file, potentially resulting in privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-62, CWE-59
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2126; https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126
CVE: CVE-2024-52561
Published: 2025-06-03
Description: A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is deleted, a root service verifies and modifies the ownership of the snapshot files. By using a symlink, an attacker can change the ownership of files owned by root to a lower-privilege user, potentially leading to privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-708, CWE-59
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2123; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2123; https://talosintelligence.com/vulnerability_reports/TALOS-2024-2123
CVE: CVE-2024-54189
Published: 2025-06-03
Description: A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is taken, a root service writes to a file owned by a normal user. By using a hard link, an attacker can write to an arbitrary file, potentially leading to privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-62, CWE-59
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2124; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2124; https://talosintelligence.com/vulnerability_reports/TALOS-2024-2124
CVE: CVE-2025-31359
Published: 2025-06-03
Description: A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879). This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2160; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2160; https://talosintelligence.com/vulnerability_reports/TALOS-2025-2160
CVE: CVE-2025-4392
Published: 2025-06-03
Description: The Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via html File uploads in all versions up to, and including, 1.7.48 due to insufficient input sanitization and output escaping within the sanitize_file() function. This makes it possible for unauthenticated attackers to bypass the plugin’s MIME-only checks and inject arbitrary web scripts in pages that will execute whenever a user accesses the html file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://github.com/anssilaitila/shared-files/blob/master/admin/class-sf-admin-allow-more-file-types.php; https://plugins.trac.wordpress.org/changeset/3304053/; https://wordpress.org/plugins/shared-files/#developers