Description (CNA)
The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is possible for a high privilege user to upload a malicious file containing JavaScript code inside an archive which will execute when a victim visits index.html inside the plugin directory.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / Autoptimize | affected 2.7.8 before 2.7.8 |
CWE
CWE-79
References
ADP enrichment
No English description supplied.