Wp Svg Images Vulnerabilities

The WP SVG Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 4.3 due to insufficient input sanitization. This makes it possible for authenticated attackers, with Author-level access and above, who have permissions to upload sanitized...

CVSS:

6.4

Affected:

up to 4.3

Fixed in:

4.4

Disclosed:

Jun 20, 2024

CVE-2024-5945 on NVD →

The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ to upload a malicious SVG and then perform XSS attacks by inducing another user to access the file directly. In v3.4, the plugin restricted such upload to editors and admin, with...

CVSS:

6.4

Affected:

up to 3.3

Fixed in:

3.4

Disclosed:

Jun 14, 2021

CVE-2021-24386 on NVD →