CVE-2022-3137

The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (such as subscriber) creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file

Score

CVSS 3.1 5.4 Medium

Status

Modified - contact@wpscan.com

Published

2022-10-10

Last modified

2024-08-03

Weaknesses

CWE-79

Affected products

• Taskbuilder (Taskbuilder)
• Taskbuilder Wordpress Project Task Management Plugin (Unknown)

References

• https://wpscan.com/vulnerability/524928d6-d4e9-4a2f-b410-46958da549d8