CVE-2024-11847
CVE-2024-11847 · WP SVG Upload <= 1.0.0 - Author+ Stored XSS via SVG
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.
CVSS 4.8 · Medium · EPSS 0.3%
- Published
- Updated
Stack: php
Affected products and versions
wp-svg-upload
- Versions
- ≥ 0, ≤ 1.0.0: Affected (semver)
No fix published
digimix/wp-svg-upload Packagist
- Affected ranges
- ECOSYSTEM: ≤ 1.0.0
No fix published