Description (CNA)
The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / Product Addons and Product Options With Custom Fields | affected 0 before 1.6.15 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.