Description
WordPress Plugin WP CSS is prone to a local file disclosure vulnerability because it fails to adequately validate user-supplied input. Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application; this may aid in further attacks. WordPress Plugin WP CSS version 2.0.5 is vulnerable; other versions may also be affected.
Remediation
Edit the source code to ensure that input is properly sanitised or disable the plugin until a fix is available
References
Related Vulnerabilities
Claroline Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2022-37159)
IBM RTC Server-Side Request Forgery (SSRF) Vulnerability (CVE-2020-4974)
XWiki Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2023-37277)
WordPress Plugin Tutor LMS-eLearning and online course solution SQL Injection (1.8.2)
WebLogic Improper Handling of Exceptional Conditions Vulnerability (CVE-2017-5638)