CVE-2022-2299 - Allow SVG Files <= 1.1 - Author+ Stored Cross Site Scripting via SVG

Back Back to CVE browser

MEDIUM

Allow SVG Files <= 1.1 - Author+ Stored Cross Site Scripting via SVG

Published Jul 25, 2022

5.4

MEDIUM

CVSS 3.1

EPSS 0.61%

Description

The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads

Affected products

Vendor n/a Product Allow svg files Default
n/a
- Version
  1.1
  Status
  affected
  Constraints
  <=1.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Allow svg files

n/a

Version	Status	Constraints
1.1	affected	<=1.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34572
Advisory
https://wpscan.com/vulnerability/29015c35-0470-41b8-b197-c71b800ae2a9
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34572		Advisory
https://wpscan.com/vulnerability/29015c35-0470-41b8-b197-c71b800ae2a9		x_refsource_MISCExploitThird Party Advisory