WordPress Bit File Manager Unrestricted File Upload Leading to XSS

From this webpage screenshot, the following key vulnerability information can be obtained: 1. Vulnerability Name: Bit File Manager - 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Upload 2. Vulnerability Type: Unrestricted Upload of File with Dangerous Type 3. CVSS Score: 6.8 (Medium) 4. Public Release Date: October 4, 2024 5. Update Date: October 5, 2024 6. Researcher: TANG Cheuk Hei (siunam) 7. Affected Versions: <= 6.5.7 8. Fixed Version: 6.5.8 9. Vulnerability Description: This vulnerability allows attackers to perform Cross-Site Scripting (XSS) attacks by uploading specific file types (such as .css and .js files), provided the attacker has Subscriber-level access and has been granted upload permissions by an administrator. 10. Remediation Recommendation: Upgrade to version 6.5.8 or higher. 11. Reference Link: plugins.trac.wordpress.org 12. Vulnerability Database: Wordfence Intelligence Vulnerability Database 13. Vulnerability Advisory: Wordfence Intelligence Vulnerability Database 14. Vulnerability Score: 6.8 (Medium) 15. Vulnerability Public Date: October 4, 2024 16. Vulnerability Update Date: October 5, 2024 17. Researcher: TANG Cheuk Hei (siunam) 18. Affected Versions: <= 6.5.7 19. Fixed Version: 6.5.8 20. Vulnerability Description: This vulnerability allows attackers to perform Cross-Site Scripting (XSS) attacks by uploading specific file types (such as .css and .js files), provided the attacker has Subscriber-level access and has been granted upload permissions by an administrator. 21. Remediation Recommendation: Upgrade to version 6.5.8 or higher. 22. Reference Link: plugins.trac.wordpress.org 23. Vulnerability Database: Wordfence Intelligence Vulnerability Database 24. Vulnerability Advisory: Wordfence Intelligence Vulnerability Database 25. Vulnerability Score: 6.8 (Medium) 26. Vulnerability Public Date: October 4, 2024 27. Vulnerability Update Date: October 5, 2024 28. Researcher: TANG Cheuk Hei (siunam) 29. Affected Versions: <= 6.5.7 30. Fixed Version: 6.5.8 31. Vulnerability Description: This vulnerability allows attackers to perform Cross-Site Scripting (XSS) attacks by uploading specific file types (such as .css and .js files), provided the attacker has Subscriber-level access and has been granted upload permissions by an administrator. 32. Remediation Recommendation: Upgrade to version 6.5.8 or higher. 33. Reference Link: plugins.trac.wordpress.org 34. Vulnerability Database: Wordfence Intelligence Vulnerability Database 35. Vulnerability Advisory: Wordfence Intelligence Vulnerability Database 36. Vulnerability Score: 6.8 (Medium) 37. Vulnerability Public Date: October 4, 2024 38. Vulnerability Update Date: October 5, 2024 39. Researcher: TANG Cheuk Hei (siunam) 40. Affected Versions: <= 6.5.7 41. Fixed Version: 6.5.8 42. Vulnerability Description: This vulnerability allows attackers to perform Cross-Site Scripting (XSS) attacks by uploading specific file types (such as .css and .js files), provided the attacker has Subscriber-level access and has been granted upload permissions by an administrator. 43. Remediation Recommendation: Upgrade to version 6.5.8 or higher. 44. Reference Link: plugins.trac.wordpress.org 45. Vulnerability Database: Wordfence Intelligence Vulnerability Database 46. Vulnerability Advisory: Wordfence Intelligence Vulnerability Database 47. Vulnerability Score: 6.8 (Medium) 48. Vulnerability Public Date: October 4, 2024 49. Vulnerability Update Date: October 5, 2024 50. Researcher: TANG Cheuk Hei (siunam) 51. Affected Versions: <= 6.5.7 52. Fixed Version: 6.5.8 53. Vulnerability Description: This vulnerability allows attackers to perform Cross-Site Scripting (XSS) attacks by uploading specific file types (such as .css and .js files), provided the attacker has Subscriber-level access and has been granted upload permissions by an administrator. 54. Remediation Recommendation: Upgrade to version 6.5.8 or higher. 55. Reference Link: plugins.trac.wordpress.org 56. Vulnerability Database: Wordfence Intelligence Vulnerability Database 57. Vulnerability Advisory: Wordfence Intelligence Vulnerability Database 58. Vulnerability Score: 6.8 (Medium) 59. Vulnerability Public Date: October 4, 2024 60. Vulnerability Update Date: October 5, 2024 61. Researcher: TANG Cheuk Hei (siunam) 62. Affected Versions: <= 6.5.7 63. Fixed Version: 6.5.8 64. Vulnerability Description: This vulnerability allows attackers to perform Cross-Site Scripting (XSS) attacks by uploading specific file types (such as .css and .js files), provided the attacker has Subscriber-level access and has been granted upload permissions by an administrator. 65. Remediation Recommendation: Upgrade to version 6.5.8 or higher. 66. Reference Link: plugins.trac.wordpress.org 67. Vulnerability Database: Wordfence Intelligence Vulnerability Database 68. Vulnerability Advisory: Wordfence Intelligence Vulnerability Database 69. Vulnerability Sco

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Bit File Manager Unrestricted File Upload Leading to XSS

More from this source