Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2024-43230 (GCVE-0-2024-43230)

Vulnerability from nvd – Published: 2024-08-26 20:19 – Updated: 2026-04-28 16:10

Title

WordPress Shared Files – Premium Download Manager & Secure File Sharing with Frontend File Upload plugin <= 1.7.28 - Sensitive Data Exposure vulnerability

Summary

Insertion of Sensitive Information Into Sent Data vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.28.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-27 13:24 UTC

CWE

CWE-201 - Insertion of Sensitive Information Into Sent Data

Assigner

Patchstack mitre root

References

1 reference

URL	Tags
https://patchstack.com/database/Wordpress/Plugin/…	vdb-entry

Impacted products

2 products

Vendor	Product	Version
Anssi Laitila	Shared Files	Affected: 0 , ≤ 1.7.28 (custom)
tammersoft	shared_files	Affected: 0 , ≤ 1.7.28 (custom) cpe:2.3:a:tammersoft:shared_files::::::::

Date Public

2026-04-01 16:27

Credits

Abdi Pranata | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:tammersoft:shared_files:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "shared_files",
            "vendor": "tammersoft",
            "versions": [
              {
                "lessThanOrEqual": "1.7.28",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43230",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-27T13:24:11.047381Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-27T13:55:59.337Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "shared-files",
          "product": "Shared Files",
          "vendor": "Anssi Laitila",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.7.29",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.7.28",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abdi Pranata | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-01T16:27:16.640Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insertion of Sensitive Information Into Sent Data vulnerability in Anssi Laitila Shared Files shared-files.\u003cp\u003eThis issue affects Shared Files: from n/a through \u003c= 1.7.28.\u003c/p\u003e"
            }
          ],
          "value": "Insertion of Sensitive Information Into Sent Data vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through \u003c= 1.7.28."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-201",
              "description": "Insertion of Sensitive Information Into Sent Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:10:09.928Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/shared-files/vulnerability/wordpress-shared-files-premium-download-manager-secure-file-sharing-with-frontend-file-upload-plugin-1-7-28-sensitive-data-exposure-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress Shared Files \u2013 Premium Download Manager \u0026 Secure File Sharing with Frontend File Upload plugin \u003c= 1.7.28 - Sensitive Data Exposure vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2024-43230",
    "datePublished": "2024-08-26T20:19:27.030Z",
    "dateReserved": "2024-08-09T09:20:16.409Z",
    "dateUpdated": "2026-04-28T16:10:09.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-32679 (GCVE-0-2024-32679)

Vulnerability from nvd – Published: 2024-04-23 14:12 – Updated: 2026-04-28 16:09

Title

WordPress Shared Files plugin <= 1.7.16 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.16.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-23 15:44 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack mitre root

References

2 references

URL	Tags
https://patchstack.com/database/Wordpress/Plugin/…	vdb-entry
https://patchstack.com/database/vulnerability/sha…	vdb-entryx_transferred

Impacted products

2 products

Vendor	Product	Version
Anssi Laitila	Shared Files	Affected: 0 , ≤ 1.7.16 (custom)
tammersoft	shared_files	Affected: 0 , ≤ 1.7.16 (semver) cpe:2.3:a:tammersoft:shared_files::::::::

Date Public

2026-04-01 16:25

Credits

Dhabaleshwar Das | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:tammersoft:shared_files:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "shared_files",
            "vendor": "tammersoft",
            "versions": [
              {
                "lessThanOrEqual": "1.7.16",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-32679",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-23T15:44:33.541573Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-06T17:33:14.953Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:13:40.473Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "https://patchstack.com/database/vulnerability/shared-files/wordpress-shared-files-plugin-1-7-16-broken-access-control-vulnerability?_s_id=cve"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "shared-files",
          "product": "Shared Files",
          "vendor": "Anssi Laitila",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.7.17",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.7.16",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dhabaleshwar Das | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-01T16:25:07.634Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.\u003cp\u003eThis issue affects Shared Files: from n/a through \u003c= 1.7.16.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through \u003c= 1.7.16."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:09:38.868Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/shared-files/vulnerability/wordpress-shared-files-plugin-1-7-16-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress Shared Files plugin \u003c= 1.7.16 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2024-32679",
    "datePublished": "2024-04-23T14:12:12.927Z",
    "dateReserved": "2024-04-17T08:55:34.510Z",
    "dateUpdated": "2026-04-28T16:09:38.868Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-4819 (GCVE-0-2023-4819)

Vulnerability from nvd – Published: 2023-10-16 19:38 – Updated: 2025-04-23 16:14

Title

Shared Files < 1.7.6 - Unauthenticated Stored Cross-Site Scripting

Summary

The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Therefore, an attacker can upload an allowed file extension injected with malicious scripts.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 16:06 UTC

CWE

CWE-79 Cross-Site Scripting (XSS)

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/4423b023-cf4a-46…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Shared Files	Affected: 0 , < 1.7.6 (custom)

Credits

Zeyad Alshahrani WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:38:00.769Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "exploit",
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/4423b023-cf4a-46cb-b314-7a09ac08b29a"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-4819",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T16:06:55.243010Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T16:14:38.486Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Shared Files",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.7.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zeyad Alshahrani"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Therefore, an attacker can upload an allowed file extension injected with malicious scripts."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-16T19:38:55.423Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/4423b023-cf4a-46cb-b314-7a09ac08b29a"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Shared Files \u003c 1.7.6 - Unauthenticated Stored Cross-Site Scripting",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2023-4819",
    "datePublished": "2023-10-16T19:38:55.423Z",
    "dateReserved": "2023-09-07T13:57:05.497Z",
    "dateUpdated": "2025-04-23T16:14:38.486Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-24856 (GCVE-0-2021-24856)

Vulnerability from nvd – Published: 2021-11-17 10:16 – Updated: 2024-08-03 19:42

Title

Shared Files < 1.6.61 - Admin+ Stored Cross-Site Scripting

Summary

The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Severity

No CVSS data available.

CWE

CWE-79 - Cross-site Scripting (XSS)

Assigner

WPScan mitre root

References

2 references

URL	Tags
https://wpscan.com/vulnerability/8fd483fb-d399-4b…	x_refsource_MISC
https://mikadmin.fr/tech/XSS-Stored-Shared-Files-…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Unknown	Shared Files – Easy Download Manager and File Sharing Plugin with Frontend File Upload	Affected: 1.6.61 , < 1.6.61 (custom)

Credits

Mika

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:42:17.305Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/8fd483fb-d399-4b4f-b4ef-bbfad1b5cf1b"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://mikadmin.fr/tech/XSS-Stored-Shared-Files-a837703ad010d111be11ffdf478aa6114F0lK656bV.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Shared Files \u2013 Easy Download Manager and File Sharing Plugin with Frontend File Upload",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.6.61",
              "status": "affected",
              "version": "1.6.61",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mika"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-17T10:16:00.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/8fd483fb-d399-4b4f-b4ef-bbfad1b5cf1b"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://mikadmin.fr/tech/XSS-Stored-Shared-Files-a837703ad010d111be11ffdf478aa6114F0lK656bV.pdf"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Shared Files \u003c 1.6.61 - Admin+ Stored Cross-Site Scripting",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2021-24856",
          "STATE": "PUBLIC",
          "TITLE": "Shared Files \u003c 1.6.61 - Admin+ Stored Cross-Site Scripting"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Shared Files \u2013 Easy Download Manager and File Sharing Plugin with Frontend File Upload",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "1.6.61",
                            "version_value": "1.6.61"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Mika"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed"
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/8fd483fb-d399-4b4f-b4ef-bbfad1b5cf1b",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/8fd483fb-d399-4b4f-b4ef-bbfad1b5cf1b"
            },
            {
              "name": "https://mikadmin.fr/tech/XSS-Stored-Shared-Files-a837703ad010d111be11ffdf478aa6114F0lK656bV.pdf",
              "refsource": "MISC",
              "url": "https://mikadmin.fr/tech/XSS-Stored-Shared-Files-a837703ad010d111be11ffdf478aa6114F0lK656bV.pdf"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2021-24856",
    "datePublished": "2021-11-17T10:16:00.000Z",
    "dateReserved": "2021-01-14T00:00:00.000Z",
    "dateUpdated": "2024-08-03T19:42:17.305Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-24736 (GCVE-0-2021-24736)

Vulnerability from nvd – Published: 2021-10-18 13:46 – Updated: 2024-08-03 19:42

Title

Shared Files < 1.6.57 - Admin+ Stored Cross-Site Scripting

Summary

The Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files WordPress plugin before 1.6.57 does not sanitise and escape some of its settings before outputting them in attributes, which could lead to Stored Cross-Site Scripting issues.

Severity

No CVSS data available.

CWE

CWE-79 - Cross-site Scripting (XSS)

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/d72275bd-0c66-4b…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Unknown	Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files	Affected: 1.6.57 , < 1.6.57 (custom)

Credits

Shivam Rai

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:42:16.864Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/d72275bd-0c66-4b2a-940d-d5256b5426cc"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Easy Download Manager and File Sharing Plugin with frontend file upload \u2013 a better Media Library \u2014 Shared Files",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.6.57",
              "status": "affected",
              "version": "1.6.57",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Shivam Rai"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Easy Download Manager and File Sharing Plugin with frontend file upload \u2013 a better Media Library \u2014 Shared Files WordPress plugin before 1.6.57 does not sanitise and escape some of its settings before outputting them in attributes, which could lead to Stored Cross-Site Scripting issues."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-18T13:46:06.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/d72275bd-0c66-4b2a-940d-d5256b5426cc"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Shared Files \u003c 1.6.57 - Admin+ Stored Cross-Site Scripting",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2021-24736",
          "STATE": "PUBLIC",
          "TITLE": "Shared Files \u003c 1.6.57 - Admin+ Stored Cross-Site Scripting"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Easy Download Manager and File Sharing Plugin with frontend file upload \u2013 a better Media Library \u2014 Shared Files",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "1.6.57",
                            "version_value": "1.6.57"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Shivam Rai"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Easy Download Manager and File Sharing Plugin with frontend file upload \u2013 a better Media Library \u2014 Shared Files WordPress plugin before 1.6.57 does not sanitise and escape some of its settings before outputting them in attributes, which could lead to Stored Cross-Site Scripting issues."
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/d72275bd-0c66-4b2a-940d-d5256b5426cc",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/d72275bd-0c66-4b2a-940d-d5256b5426cc"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2021-24736",
    "datePublished": "2021-10-18T13:46:06.000Z",
    "dateReserved": "2021-01-14T00:00:00.000Z",
    "dateUpdated": "2024-08-03T19:42:16.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-43230 (GCVE-0-2024-43230)

Vulnerability from cvelistv5 – Published: 2024-08-26 20:19 – Updated: 2026-04-28 16:10

Title

WordPress Shared Files – Premium Download Manager & Secure File Sharing with Frontend File Upload plugin <= 1.7.28 - Sensitive Data Exposure vulnerability

Summary

Insertion of Sensitive Information Into Sent Data vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.28.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-27 13:24 UTC

CWE

CWE-201 - Insertion of Sensitive Information Into Sent Data

Assigner

Patchstack mitre root

References

1 reference

URL	Tags
https://patchstack.com/database/Wordpress/Plugin/…	vdb-entry

Impacted products

2 products

Vendor	Product	Version
Anssi Laitila	Shared Files	Affected: 0 , ≤ 1.7.28 (custom)
tammersoft	shared_files	Affected: 0 , ≤ 1.7.28 (custom) cpe:2.3:a:tammersoft:shared_files::::::::

Date Public

2026-04-01 16:27

Credits

Abdi Pranata | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:tammersoft:shared_files:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "shared_files",
            "vendor": "tammersoft",
            "versions": [
              {
                "lessThanOrEqual": "1.7.28",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43230",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-27T13:24:11.047381Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-27T13:55:59.337Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "shared-files",
          "product": "Shared Files",
          "vendor": "Anssi Laitila",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.7.29",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.7.28",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abdi Pranata | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-01T16:27:16.640Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insertion of Sensitive Information Into Sent Data vulnerability in Anssi Laitila Shared Files shared-files.\u003cp\u003eThis issue affects Shared Files: from n/a through \u003c= 1.7.28.\u003c/p\u003e"
            }
          ],
          "value": "Insertion of Sensitive Information Into Sent Data vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through \u003c= 1.7.28."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-201",
              "description": "Insertion of Sensitive Information Into Sent Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:10:09.928Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/shared-files/vulnerability/wordpress-shared-files-premium-download-manager-secure-file-sharing-with-frontend-file-upload-plugin-1-7-28-sensitive-data-exposure-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress Shared Files \u2013 Premium Download Manager \u0026 Secure File Sharing with Frontend File Upload plugin \u003c= 1.7.28 - Sensitive Data Exposure vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2024-43230",
    "datePublished": "2024-08-26T20:19:27.030Z",
    "dateReserved": "2024-08-09T09:20:16.409Z",
    "dateUpdated": "2026-04-28T16:10:09.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-32679 (GCVE-0-2024-32679)

Vulnerability from cvelistv5 – Published: 2024-04-23 14:12 – Updated: 2026-04-28 16:09

Title

WordPress Shared Files plugin <= 1.7.16 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.16.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-23 15:44 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack mitre root

References

2 references

URL	Tags
https://patchstack.com/database/Wordpress/Plugin/…	vdb-entry
https://patchstack.com/database/vulnerability/sha…	vdb-entryx_transferred

Impacted products

2 products

Vendor	Product	Version
Anssi Laitila	Shared Files	Affected: 0 , ≤ 1.7.16 (custom)
tammersoft	shared_files	Affected: 0 , ≤ 1.7.16 (semver) cpe:2.3:a:tammersoft:shared_files::::::::

Date Public

2026-04-01 16:25

Credits

Dhabaleshwar Das | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:tammersoft:shared_files:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "shared_files",
            "vendor": "tammersoft",
            "versions": [
              {
                "lessThanOrEqual": "1.7.16",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-32679",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-23T15:44:33.541573Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-06T17:33:14.953Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:13:40.473Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "https://patchstack.com/database/vulnerability/shared-files/wordpress-shared-files-plugin-1-7-16-broken-access-control-vulnerability?_s_id=cve"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "shared-files",
          "product": "Shared Files",
          "vendor": "Anssi Laitila",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.7.17",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.7.16",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dhabaleshwar Das | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-01T16:25:07.634Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.\u003cp\u003eThis issue affects Shared Files: from n/a through \u003c= 1.7.16.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through \u003c= 1.7.16."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:09:38.868Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/shared-files/vulnerability/wordpress-shared-files-plugin-1-7-16-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress Shared Files plugin \u003c= 1.7.16 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2024-32679",
    "datePublished": "2024-04-23T14:12:12.927Z",
    "dateReserved": "2024-04-17T08:55:34.510Z",
    "dateUpdated": "2026-04-28T16:09:38.868Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-4819 (GCVE-0-2023-4819)

Vulnerability from cvelistv5 – Published: 2023-10-16 19:38 – Updated: 2025-04-23 16:14

Title

Shared Files < 1.7.6 - Unauthenticated Stored Cross-Site Scripting

Summary

The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Therefore, an attacker can upload an allowed file extension injected with malicious scripts.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 16:06 UTC

CWE

CWE-79 Cross-Site Scripting (XSS)

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/4423b023-cf4a-46…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	Shared Files	Affected: 0 , < 1.7.6 (custom)

Credits

Zeyad Alshahrani WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:38:00.769Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "exploit",
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/4423b023-cf4a-46cb-b314-7a09ac08b29a"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-4819",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T16:06:55.243010Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T16:14:38.486Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Shared Files",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.7.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zeyad Alshahrani"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Therefore, an attacker can upload an allowed file extension injected with malicious scripts."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-16T19:38:55.423Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/4423b023-cf4a-46cb-b314-7a09ac08b29a"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Shared Files \u003c 1.7.6 - Unauthenticated Stored Cross-Site Scripting",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2023-4819",
    "datePublished": "2023-10-16T19:38:55.423Z",
    "dateReserved": "2023-09-07T13:57:05.497Z",
    "dateUpdated": "2025-04-23T16:14:38.486Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-24856 (GCVE-0-2021-24856)

Vulnerability from cvelistv5 – Published: 2021-11-17 10:16 – Updated: 2024-08-03 19:42

Title

Shared Files < 1.6.61 - Admin+ Stored Cross-Site Scripting

Summary

The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Severity

No CVSS data available.

CWE

CWE-79 - Cross-site Scripting (XSS)

Assigner

WPScan mitre root

References

2 references

URL	Tags
https://wpscan.com/vulnerability/8fd483fb-d399-4b…	x_refsource_MISC
https://mikadmin.fr/tech/XSS-Stored-Shared-Files-…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Unknown	Shared Files – Easy Download Manager and File Sharing Plugin with Frontend File Upload	Affected: 1.6.61 , < 1.6.61 (custom)

Credits

Mika

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:42:17.305Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/8fd483fb-d399-4b4f-b4ef-bbfad1b5cf1b"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://mikadmin.fr/tech/XSS-Stored-Shared-Files-a837703ad010d111be11ffdf478aa6114F0lK656bV.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Shared Files \u2013 Easy Download Manager and File Sharing Plugin with Frontend File Upload",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.6.61",
              "status": "affected",
              "version": "1.6.61",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mika"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-17T10:16:00.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/8fd483fb-d399-4b4f-b4ef-bbfad1b5cf1b"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://mikadmin.fr/tech/XSS-Stored-Shared-Files-a837703ad010d111be11ffdf478aa6114F0lK656bV.pdf"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Shared Files \u003c 1.6.61 - Admin+ Stored Cross-Site Scripting",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2021-24856",
          "STATE": "PUBLIC",
          "TITLE": "Shared Files \u003c 1.6.61 - Admin+ Stored Cross-Site Scripting"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Shared Files \u2013 Easy Download Manager and File Sharing Plugin with Frontend File Upload",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "1.6.61",
                            "version_value": "1.6.61"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Mika"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed"
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/8fd483fb-d399-4b4f-b4ef-bbfad1b5cf1b",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/8fd483fb-d399-4b4f-b4ef-bbfad1b5cf1b"
            },
            {
              "name": "https://mikadmin.fr/tech/XSS-Stored-Shared-Files-a837703ad010d111be11ffdf478aa6114F0lK656bV.pdf",
              "refsource": "MISC",
              "url": "https://mikadmin.fr/tech/XSS-Stored-Shared-Files-a837703ad010d111be11ffdf478aa6114F0lK656bV.pdf"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2021-24856",
    "datePublished": "2021-11-17T10:16:00.000Z",
    "dateReserved": "2021-01-14T00:00:00.000Z",
    "dateUpdated": "2024-08-03T19:42:17.305Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-24736 (GCVE-0-2021-24736)

Vulnerability from cvelistv5 – Published: 2021-10-18 13:46 – Updated: 2024-08-03 19:42

Title

Shared Files < 1.6.57 - Admin+ Stored Cross-Site Scripting

Summary

The Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files WordPress plugin before 1.6.57 does not sanitise and escape some of its settings before outputting them in attributes, which could lead to Stored Cross-Site Scripting issues.

Severity

No CVSS data available.

CWE

CWE-79 - Cross-site Scripting (XSS)

Assigner

WPScan mitre root

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/d72275bd-0c66-4b…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Unknown	Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files	Affected: 1.6.57 , < 1.6.57 (custom)

Credits

Shivam Rai

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:42:16.864Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/d72275bd-0c66-4b2a-940d-d5256b5426cc"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Easy Download Manager and File Sharing Plugin with frontend file upload \u2013 a better Media Library \u2014 Shared Files",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.6.57",
              "status": "affected",
              "version": "1.6.57",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Shivam Rai"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Easy Download Manager and File Sharing Plugin with frontend file upload \u2013 a better Media Library \u2014 Shared Files WordPress plugin before 1.6.57 does not sanitise and escape some of its settings before outputting them in attributes, which could lead to Stored Cross-Site Scripting issues."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-18T13:46:06.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/d72275bd-0c66-4b2a-940d-d5256b5426cc"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Shared Files \u003c 1.6.57 - Admin+ Stored Cross-Site Scripting",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2021-24736",
          "STATE": "PUBLIC",
          "TITLE": "Shared Files \u003c 1.6.57 - Admin+ Stored Cross-Site Scripting"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Easy Download Manager and File Sharing Plugin with frontend file upload \u2013 a better Media Library \u2014 Shared Files",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "1.6.57",
                            "version_value": "1.6.57"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Shivam Rai"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Easy Download Manager and File Sharing Plugin with frontend file upload \u2013 a better Media Library \u2014 Shared Files WordPress plugin before 1.6.57 does not sanitise and escape some of its settings before outputting them in attributes, which could lead to Stored Cross-Site Scripting issues."
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/d72275bd-0c66-4b2a-940d-d5256b5426cc",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/d72275bd-0c66-4b2a-940d-d5256b5426cc"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2021-24736",
    "datePublished": "2021-10-18T13:46:06.000Z",
    "dateReserved": "2021-01-14T00:00:00.000Z",
    "dateUpdated": "2024-08-03T19:42:16.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

10 vulnerabilities found for shared_files by tammersoft

CVE-2024-43230 (GCVE-0-2024-43230)

CVE-2024-32679 (GCVE-0-2024-32679)

CVE-2023-4819 (GCVE-0-2023-4819)

CVE-2021-24856 (GCVE-0-2021-24856)

CVE-2021-24736 (GCVE-0-2021-24736)

CVE-2024-43230 (GCVE-0-2024-43230)

CVE-2024-32679 (GCVE-0-2024-32679)

CVE-2023-4819 (GCVE-0-2023-4819)

CVE-2021-24856 (GCVE-0-2021-24856)

CVE-2021-24736 (GCVE-0-2021-24736)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

10 vulnerabilities found for shared_files by tammersoft

CVE-2024-43230 (GCVE-0-2024-43230)

CVE-2024-32679 (GCVE-0-2024-32679)

CVE-2023-4819 (GCVE-0-2023-4819)

CVE-2021-24856 (GCVE-0-2021-24856)

CVE-2021-24736 (GCVE-0-2021-24736)

CVE-2024-43230 (GCVE-0-2024-43230)

CVE-2024-32679 (GCVE-0-2024-32679)

CVE-2023-4819 (GCVE-0-2023-4819)

CVE-2021-24856 (GCVE-0-2021-24856)

CVE-2021-24736 (GCVE-0-2021-24736)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.