title: TaskBuilder < 1.0.8 - Subscriber+ Stored XSS via SVG file upload
description: The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (such as subscriber) creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file
problem types: CWE-79 Cross-Site Scripting (XSS)
affected:
{
vendor: Unknown
product: Taskbuilder – WordPress Project & Task Management plugin
versions:
version: 1.0.8, status: affected, lessThan: 1.0.8, versionType: custom
}