The wp-enable-svg WordPress plugin does not sanitize SVG files when uploaded

MITTEL 4.8CVE-2024-11184 · GHSA-j77f-79w9-rghc · Published 02/01/2025 · updated 17/06/2026

Kurz gesagt

CVE-2024-11184 ist eine Schwachstelle (MITTEL (CVSS 4.8)) in mwdelaney/wp-enable-svg, wp enable svg (wp enable svg project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.43%, höher als bei 37.2% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
mwdelaney/wp-enable-svg Packagist	`≤ 0.2`	No fix yet
wp enable svg wp_enable_svg_project	`≤ 0.7`	No fix yet

Description

The wp-enable-svg WordPress plugin through 0.2 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts

NVD description

The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts

References

nvd.nist.gov/vuln/detail/CVE-2024-11184 · ADVISORY
MWDelaney/wp-enable-svg · PACKAGE
wpscan.com/vulnerability/fc982bcb-9974-481f-aef4-580ae9edc3c8 · WEB
wpscan.com/vulnerability/fc982bcb-9974-481f-aef4-580ae9edc3c8 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free