The Support SVG WordPress plugin before 1.1.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/ed1b1540-a0e2-434e-8769-9532c3ed5e31/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/ed1b1540-a0e2-434e-8769-9532c3ed5e31/ | Exploit Third Party Advisory |
Configurations
History
15 May 2025, 18:29
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sayedulsayem support Svg
Sayedulsayem |
|
| CWE | CWE-79 | |
| References | () https://wpscan.com/vulnerability/ed1b1540-a0e2-434e-8769-9532c3ed5e31/ - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:sayedulsayem:support_svg:*:*:*:*:*:wordpress:*:* |
13 Jul 2024, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-13 06:15
Updated : 2025-05-15 18:29
NVD link : CVE-2024-4272
Mitre link : CVE-2024-4272
JSON object : View
Products Affected
sayedulsayem
- support_svg
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')