plugin

Easy Svg Image Allow Vulnerabilities

2 known security issues reported for the Easy Svg Image Allow WordPress plugin. Most recent disclosed Jan 29, 2024.

1 medium

Running Easy Svg Image Allow on your site? Check whether your installed version is affected.

Scan your site free

Easy SVG Allow [easy-svg-image-allow] <= 1.0 (unfixed + closed)

unknown

[en] The Easy SVG Allow WordPress plugin through 1.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.

Affected:
up to 1.0
Fix:
No patched version reported
Disclosed:
Jan 29, 2024

CVE-2023-7089 on NVD →

Easy SVG Allow <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG

medium

The Easy SVG Allow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded SVG file in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary...

CVSS:
6.4
Affected:
up to 1.0
Fix:
No patched version reported
Disclosed:
Jan 3, 2024

CVE-2023-7089 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database