CVE-2024-10016: Improper Neutralization of Input During Web Page Generation

The File Upload Types by WPForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level...

WordPress plugin “File Upload Types by WPForms” has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in PHP. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress plugin File Upload Typ...

PT-2024-15976 · Wpforms · File Upload Types

Name of the Vulnerable Software and Affected Versions: File Upload Types by WPForms plugin for WordPress versions up to, and including, 1.4.0 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allo...

CVE-2024-37383

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes...

CVE-2024-8959

The WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.1.6 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-8959

CVE-2024-8959 - WP Adminify (WordPress Plugin) Affected: WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer (versions

CVE-2024-8959 WP Adminify – Best WordPress Custom Dashboard Plugin <= 4.0.1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.1.6 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-8959 WP Adminify – Best WordPress Custom Dashboard Plugin <= 4.0.1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.1.6 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress WP Adminify plugin <= 4.0.1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin WP Adminify versions = 4.0.1.6...

PT-2024-39337

Name of the Vulnerable Software and Affected Versions: WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer plugin for WordPress versions up to, and including, 4.0.1.6 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input...

CVE-2024-8959: Improper Neutralization of Input During Web Page Generation

The WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.1.6 due to insufficient input sanitization and output escaping. This makes it possible for...

RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability

RoundCube Webmail contains a cross-site scripting XSS vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code...

SVG Embed - Moderately critical - Cross site scripting - SA-CONTRIB-2024-050

This module enables you to embed the content of an SVG file into the body html of a node and optionally allows to translate text contained within the image. The module doesn't sufficiently sanitize the SVG file before embedding it into the html. This vulnerability is mitigated by the fact that an...

Views SVG Animation - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-051

This module enables you to animate an SVG graphic by selecting certain rows in a view. The module doesn't sufficiently sanitize the SVG file before embedding it into the html. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to upload SVG files...

PT-2025-2102 · Drupal · Drupal Views Svg Animation

Name of the Vulnerable Software and Affected Versions: Drupal Views SVG Animation versions 0.0.0 through 1.0.0 Description: The issue is related to improper neutralization of input during web page generation, which allows Cross-Site Scripting XSS. This can be exploited by a remote attacker to...

Drupal Views SVG Animation module < 1.0.1 - Authenticated Cross Site Scripting (XSS) vulnerability

Authenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff in WordPress Module Views SVG Animation versions 1.0.1...

Drupal SVG Embed module < 2.1.2 - Authenticated Cross Site Scripting (XSS) vulnerability

Authenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff in WordPress Module SVG Embed versions 2.1.2...

GHSA-5955-CWV4-H7QH Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice

Impact There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode. Workarounds Server-side file validation is available to strip script tags from file's content during the file upload process...

Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice

Impact There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode. Workarounds Server-side file validation is available to strip script tags from file's content during the file upload process...

CVE-2024-48927

Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full...