CVE-2019-14216
HIGHWP SVG Icons < 3.2.1 - Cross-Site Request Forgery via Custom Icon Upload
Title source: llmDescription
An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg-icons-custom-set mishandles Custom Icon uploads. CSRF leads to upload of a ZIP archive containing a .php file.
References (2)
Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://zeroauth.ltd/blog/2019/08/09/cve-2019-14216-svg-vector-icon-plugin-wordpress-plugin-vulnerable-to-csrf-and-arbitrary-file-upload-leading-to-remote-code-execution/
Patch, Third Party Advisory x_refsource_misc
https://wpvulndb.com/vulnerabilities/9510
Scores
CVSS v3
8.8
EPSS
0.0084
EPSS Percentile
53.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-352
Status
published
Products (1)
wp_svg_icons_project/wp_svg_icons
< 3.2.1
Published
Aug 14, 2019
Tracked Since
Feb 18, 2026