CVE-2024-13504
Published: 31 January 2025
Description
The Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dfxp File uploads in all versions up to, and including, 1.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the dfxp file. This issue affects only Apache-based environments, where dfxp files are handled by default.
Security Summary
CVE-2024-13504 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79, in the Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress. It affects all versions up to and including 1.7.42 due to insufficient input sanitization and output escaping in the handling of dfxp file uploads. This issue is limited to Apache-based environments, where dfxp files are processed by default, enabling injection of arbitrary web scripts into pages.
Unauthenticated attackers can exploit the vulnerability over the network with low complexity, no privileges, and no user interaction required, as reflected in its CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). By uploading a malicious dfxp file, attackers inject scripts that execute whenever any user accesses the file, potentially leading to low-level impacts on confidentiality and integrity with a changed scope.
Advisories from Wordfence provide threat intelligence details, while WordPress plugin repository references indicate mitigation through updates, including code changes in the trunk (changeset from 3229309 to 3231372) and examination of tag 1.7.40, suggesting patches in subsequent versions beyond 1.7.42.
Details
- CWE(s)