CVE-2023-3720
Upload Media By URL < 1.0.8 - Stored XSS via CSRF
- State
- Published
- Severity
- 6.5 Medium
- Published
- Aug 30, 2023
- Updated
- May 5, 2025
- Reserved
- Jul 17, 2023
Description
The Upload Media By URL WordPress plugin before 1.0.8 does not have CSRF check when uploading files, which could allow attackers to make logged in admins upload files (including HTML containing JS code for users with the unfiltered_html capability) on their behalf.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Upload Media By URLUnknown |
|
References
- https://wpscan.com/vulnerability/16375a7f-0a9f-4961-8510-d047ffbf3954exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.