CVE-2024-10016
Published
CVSS v3
6.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT
Description
The File Upload Types by WPForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
<h3>WordPress File Upload Types Plugin</h3>
<p>Do you want to let your WordPress website accept uploads from your users for more file types and to freely upload files? We created the File Upload Types plugin to make it simple for anyone to easily add support for any file types with any extension or MIME type.</p>
<h4>How WordPress File Uploads Work</h4>
<p>By default, WordPress only allows <a href="https://codex.wordpress.org/Uploading_Files#About_Uploading_Files_on_Dashboard" rel="nofollow ugc">certain file types</a> to be uploaded to your website’s media library.</p>
<p>If someone tries to upload a file type outside of these whitelisted WordPress file extensions, this can be the cause of the <a href="https://www.wpbeginner.com/common-wordpress-errors-and-how-to-fix-them/?utm_source=wprepo&utm_medium=link&utm_campaign=fileuploadtyes&utm_content=readme" title="common WordPress error" rel="friend nofollow ugc">common WordPress error</a> <code>Sorry, this file type is not permitted for security reasons</code> message.</p>
<p>It can be frustrating if you’ve <a href="https://wpforms.com/how-to-create-a-file-upload-form-in-wordpress/?utm_source=wprepo&utm_medium=link&utm_campaign=fileuploadtypes&utm_content=readme" rel="friend" title="
created a file upload form">created a file upload form</a> in WordPress but the file type you want to accept is a file extension that’s not allowed.</p>
<p>This plugin lets your website upload more file types beyond the limited file extension types that WordPress allows by default.</p>
<h4>How does the File Upload Types plugin work?</h4>
<p>The File Upload Types plugin works by letting you adjust the internal file whitelist, letting you manually control which types of file extensions your WordPress website can upload.</p>
<p>This way, you can accept any file type through your website and/or any contact form plugin like <a href="https://www.wpforms.com/?utm_source=wprepo&utm_medium=link&utm_campaign=fileuploadtypes&utm_content=readme" title="WPForms" rel="friend nofollow ugc">WPForms</a>.</p>
<h4>What file types can I upload to WordPress with this plugin?</h4>
<p>The File Upload Types plugin lets you allow uploads of any file extension, including custom file types.</p>
<p>Some common file extension types this plugin lets you add that WordPress doesn’t support natively include:</p>
<p>.ai<br />
.zip<br />
.xml<br />
.svg<br />
.csv<br />
.mobi<br />
.cad<br />
.dwg<br />
.dxf</p>
<p>…and any other file extensions that exist, including custom file types.</p>
<p>We hope that you find the File Upload Types plugin helpful!</p>
<h3>Credits</h3>
<p>This plugin was created by the team behind <a href="https://wpforms.com/?utm_source=wprepo&utm_medium=link&utm_campaign=fileuploadtyes&utm_content=readme" rel="friend nofollow ugc">WPForms</a> – the best drag & drop form builder for WordPress.</p>
<h3>What’s Next</h3>
<p>If you like this plugin, then consider checking out our other projects:</p>
<ul>
<li><a href="https://wpforms.com/?utm_source=wprepo&utm_medium=link&utm_campaign=fileuploadtyes&utm_content=readme" title="OptinMonster" rel="friend nofollow ugc">WPForms</a> – The best WordPress Contact Form Plugin.</li>
<li><a href="https://optinmonster.com/?utm_source=wprepo&utm_medium=link&utm_campaign=fileuploadtyes&utm_content=readme" title="OptinMonster" rel="friend nofollow ugc">OptinMonster</a> – Get more email subscribers with the most popular conversion optimization plugin for WordPress.</li>
<li><a href="https://www.monsterinsights.com/?utm_source=wprepo&utm_medium=link&utm_campaign=fileuploadtyes&utm_content=readme" title="MonsterInsights" rel="friend nofollow ugc">MonsterInsights</a> – See the stats that matter and grow your business with confidence. Best Google Analytics plugin for WordPress.</li>
<li><a href="https://www.seedprod.com/?utm_source=wprepo&utm_medium=link&utm_campaign=fileuploadtyes&utm_content=readme" title="SeedProd" rel="friend nofollow ugc">SeedProd</a> – Jumpstart your website with the #1 Coming Soon & Maintenance Mode plugin for WordPress.</li>
<li><a href="https://wpmailsmtp.com/?utm_source=wprepo&utm_medium=link&utm_campaign=fileuploadtyes&utm_content=readme" rel="nofollow ugc">WP Mail SMTP</a> – Improve email deliverability for your contact form with the most popular SMTP plugin for WordPress.</li>
<li><a href="https://rafflepress.com/?utm_source=wprepo&utm_medium=link&utm_campaign=fileuploadtyes&utm_content=readme" rel="nofollow ugc">RafflePress</a> – The Best WordPress giveaway and contest plugin.</li>
</ul>
<p>Visit <a href="http://www.wpbeginner.com/?utm_source=wprepo&utm_medium=link&utm_campaign=fileuploadtyes&utm_content=readme" title="WPBeginner" rel="friend nofollow ugc">WPBeginner</a> to learn from our <a href="http://www.wpbeginner.com/category/wp-tutorials/?utm_source=wprepo&utm_medium=link&utm_campaign=fileuploadtyes&utm_content=readme" title="WordPress Tutorials" rel="friend nofollow ugc">WordPress tutorials</a> and find out about other <a href="http://www.wpbeginner.com/category/plugins/?utm_source=wprepo&utm_medium=link&utm_campaign=fileuploadtyes&utm_content=readme" title="Best WordPress plugins" rel="friend nofollow ugc">best WordPress plugins</a>.</p>
WordPress Plugin Directory