Threats tagged 'ghsa-6x39-87p4-cf54'

The Checkout Files Upload for WooCommerce WordPress plugin versions before 2.4.1 contains a vulnerability where it does not properly verify that uploaded files at checkout are allowed image types. This flaw allows unauthenticated users to upload HTML files disguised as images, which can execute JavaScript in the browser of a shop manager or administrator viewing the order screen. This issue is a regression of a previously fixed vulnerability (CVE-2025-4212) and was reintroduced in version 2.4.0.