CVE-2021-24378 — Autoptimize < 2.7.8 - Authenticated Stored XSS via File Upload
The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is poss…
Published: 2021-06-21 · CVSS: Unscored
The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is possible for a high privilege user to upload a malicious file containing JavaScript code inside an archive which will execute when a victim visits index.html inside the plugin directory.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7