title: Frontend Uploader <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting
description: The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Frontend Uploader
vendor: Unknown
versions:
lessThanOrEqual: 1.3.2, status: affected, version: 1.3.2, versionType: custom
}