← CVE Intelligence

CVE-2022-3137

TaskBuilder < 1.0.8 - Subscriber+ Stored XSS via SVG file upload PUBLISHED

Description (CNA)

The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (such as subscriber) creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file

Affected (CNA)

Vendor / productVersions
Unknown / Taskbuilder – WordPress Project & Task Management pluginaffected 1.0.8 before 1.0.8

CWE

CWE-79

References

ADP enrichment

CVE

No English description supplied.