CVE-2024-11184
CVE-2024-11184 · WP Enabled SVG <= 0.7 - Author+ Stored XSS via SVG
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts
CVSS 4.8 · Medium · EPSS 0.4%
- Published
- Updated
Stack: php
Affected products and versions
wp-enable-svg
- Versions
- ≥ 0, ≤ 0.7: Affected (semver)
No fix published
mwdelaney/wp-enable-svg Packagist
- Versions
- 0.1
- 0.2
- Affected ranges
- ECOSYSTEM: ≤ 0.2
No fix published