WordPress CVEs

Description

The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a lack of proper checks on allowed file types. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.

Affected WordPress components

• File Manager Plugin · file-manager
  Possible match Active
  Up to and including 6.5.7
  View on WordPress.org
• File Manager Plugin · wp-file-manager
  Possible match Active
  Up to and including 6.5.7
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• bitpressadmin File Manager — Up to and including 6.5.7
• bitapps file_manager — Before 6.5.8

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3161219/
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/314520d5-bd9d-46c1-b903-5e5cb3bb3417?source=cve
• nvd.nist.gov Official NVD record