In short
- CVE-2024-11847 is a MEDIUM (CVSS 4.8) vulnerability affecting digimix/wp-svg-upload, wp svg upload (wp svg upload project).
- Chance of exploitation in the next 30 days (EPSS): 0.27%, higher than 18.9% of all vulnerabilities.
- No patched version is listed yet: follow the vendor's advisory in References.
Description
The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.
NVD description
The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free