Allow SVG Files <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting
medium
The Allow SVG Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG uploads in versions up to, and including, 1.1 due to insufficient sanitization and escaping on the SVG file. This makes it possible for authenticated attackers with file uploading capabilities, like an author, to inject arbitr...
- CVSS:
- 6.4
- Affected:
- up to 1.1
- Fix:
- No patched version reported
- Disclosed:
- Jul 4, 2022
CVE-2022-2299 on NVD →
Allow SVG Files <= 1.0 - Authenticated (Admin+) Arbitrary File Upload
high
The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP files even when they are not allowed to
- CVSS:
- 7.2
- Affected:
- up to 1.1
- Fixed in:
- 1.1
- Disclosed:
- May 30, 2020
CVE-2022-1939 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database