Description
The Uploading SVG, WEBP and ICO files WordPress plugin through 1.2.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Exploits (1)
References (1)
Core 1
Core References
Exploit, Third Party Advisory exploit
vdb-entry
technical-description
https://wpscan.com/vulnerability/82f8d425-449a-471f-94df-8439924fd628
Scores
CVSS v3
5.4
EPSS
0.0730
EPSS Percentile
91.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (1)
uploading_svg\,_webp_and_ico_files_project/uploading_svg\,_webp_and_ico_files
< 1.2.1
Published
Dec 04, 2023
Tracked Since
Feb 18, 2026