Threats tagged 'ghsa-g4xp-7w4v-pwhq'

The AskAny WordPress plugin versions before 2.2.0 have a vulnerability where the plugin does not properly validate the extension or content of files attached to chat messages. It relies on the browser-supplied file type, allowing unauthenticated users to upload PHP files and potentially execute arbitrary code if visitor attachments are enabled.