- This script is possibly vulnerable to XSS (Cross-site scripting). The web application allows file upload and Acunetix was able to upload a file containing HTML content. When HTML files are allowed, XSS payload can be injected in the file uploaded. Check Attack details for more information about this attack.
- Restrict file types accepted for upload: check the file extension and only allow certain files to be uploaded. Use a whitelist approach instead of a blacklist. Check for double extensions such as .php.png. Check for files without a filename like .htaccess (on ASP.NET, check for configuration files like web.config). Change the permissions on the upload folder so the files within it are not executable. If possible, rename the files that are uploaded.
- WordPress Plugin qTranslate Cross-Site Scripting (2.5.39)
- WordPress Plugin User Login Log Cross-Site Scripting (2.2.2)
- WordPress Plugin Google Language Translator Cross-Site Scripting (5.0.05)
- WordPress Plugin Simple Ads Manager Arbitrary File Upload (2.5.94)
- WordPress Plugin Social Sharing Toolkit Cross-Site Scripting (2.1.1)