Pixabay Images <= 2.3 - Multiple Vulnerabilities (RCE, XSS, ...)Sign up to our free email alerts service for instant vulnerability notifications!
1) Authentication bypass The plugin does not correctly check if the user is logged in. Certain code can be called without authentication 2) Arbitrary file upload The plugin code does not validate the host in the provided download URL, which allows to upload malicious files, including PHP code. 3) Path Traversal Certain values are not sanitized before they are used in a file operation. This allows to store files outside of the "download" folder. 4) Cross Site Scripting (XSS) The generated author link uses unsanitized user values which can be abused for Cross Site Scripting (XSS) attacks.
fixed in version 2.4
|Publicly Published||2015-02-04 (almost 2 years ago)|
|Added||2015-01-19 (almost 2 years ago)|
|Last Updated||2015-05-15 (over 1 year ago)|
Copyright & License
|Copyright||All data and resources contained within this page and this web site is Copyright © The WPScan Team.|
|License||Some of this data may be used for non-commercial purposes, however, any potential commercial usage of this data will require a license. If you would like to inquire about a commercial license please contact us.|