2022-10-10 00:00:00
WPScan
PUBLISHED
The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise tasks attachments, which could allow any authenticated user (such as subscriber) creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file