CVE-2023-6541: Improper Neutralization of Input During Web Page Generation

The Allow SVG WordPress plugin before 1.2.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

PT-2024-17152 · WordPress · Wp-Svg

Name of the Vulnerable Software and Affected Versions: WP-SVG WordPress plugin versions 0.9 and prior Description: The issue concerns the WP-SVG WordPress plugin, which does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is...

PT-2024-30114 · WordPress · Support Svg Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Support SVG WordPress plugin versions prior to 1.1.0 Description: The issue allows users with at least the author role to upload SVG files containing malicious JavaScript, leading to Stored XSS attacks. This is due to the lack of...

CVE-2023-7085: Improper Neutralization of Input During Web Page Generation

The Scalable Vector Graphics SVG WordPress plugin through 3.4 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...