GitHub Advisoryadvisory · Packagist

GHSA-v2rr-fhv8-mx74 wp-svg-upload WordPress plugin vulnerable to Stored Cross-site Scripting

MEDIUM Published 2025-03-26 Modified 2025-04-01 Official page ↗
Aliases
CVE-2024-11847
Ecosystem
Packagist
Packages
digimix/wp-svg-upload
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-04-01

Affected packages

• Packagist digimix/wp-svg-upload: <= 1.0.0 (no fix yet)

Description

The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.

Related

Alias · CVE (1)

  • CVE-2024-11847 The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References