The Verge3D Publishing and E-Commerce WordPress plugin prior to version 4.13.1 does not properly validate the contents of files uploaded through its file storage feature. Additionally, it serves these files with content types controlled by the attacker. This vulnerability enables unauthenticated attackers to store files containing malicious JavaScript, which executes in the browser context of any user who accesses the file, resulting in a Cross-Site Scripting (CWE-79) attack.

Unauthenticated attackers can upload malicious JavaScript files that execute in the browsers of users who open the files, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability affects all users who interact with the uploaded files, exposing them to client-side code execution risks.

Upgrade the Verge3D Publishing and E-Commerce plugin to version 4.13.1 or later, where this vulnerability is fixed. Since the vulnerability is addressed in the fixed version, applying this official update fully mitigates the risk.