CVE-2022-3137 — TaskBuilder < 1.0.8 - Subscriber+ Stored XSS via SVG file upload
The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (such as subscriber) creating a task to…
Published: 2022-10-10 · CVSS: Unscored
The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (such as subscriber) creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7