Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-4392
CVE-2025-4392:
WordPress vulnerability analysis and mitigation
Overview
The Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress (versions up to 1.7.48) contains a Stored Cross-Site Scripting vulnerability. The vulnerability exists due to insufficient input sanitization and output escaping within the sanitize_file() function, which allows unauthenticated attackers to bypass the plugin's MIME-only checks and inject arbitrary web scripts that execute when users access HTML files (NVD CVE, WordPress Plugin).
Technical details
The vulnerability is present in the sanitize_file() function within the plugin's file handling mechanism. The function fails to properly validate and sanitize HTML file uploads, allowing attackers to bypass MIME-type checks. The vulnerability has been assigned a CVSS v3.1 base score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, and no required privileges (NVD CVE).
Impact
When exploited, this vulnerability allows attackers to inject malicious scripts that execute in users' browsers when accessing uploaded HTML files. This can lead to various attacks including cookie theft, session hijacking, and other client-side attacks that could compromise user security (NVD CVE).
Mitigation and workarounds
The vulnerability has been patched in version 1.7.49 of the plugin. Users are strongly advised to update to this version immediately. The update includes improved input sanitization and output escaping mechanisms in the sanitize_file() function (WordPress Plugin).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management