CVE-2024-10325 Elementor Header & Footer Builder <= 1.6.45 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.6.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-10325

CVE-2024-10325 affects Elementor Header & Footer Builder (Ultimate Addons for Elementor) for WordPress. Desktop/REST SVG File Uploads allow Stored XSS due to insufficient input sanitization and output escaping in SVG handling. Affected versions: up to 1.6.45. Exploitation requires authentication ...

CVE-2024-10269

The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access a...

CVE-2024-10269

The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access a...

CVE-2024-10269

CVE-2024-10269 – Easy SVG Support (WordPress) stores cross-site scripting via REST API SVG uploads in all versions up to 3.7. Authorized users with Author+ access can upload an SVG and inject script that executes when pages with that SVG are viewed. Root cause: insufficient input sanitization and...

CVE-2024-10269 Easy SVG Support <= 3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access a...

CVE-2024-10269 Easy SVG Support <= 3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access a...

WordPress Easy SVG Support plugin <= 3.7 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Francesco Carlucci in WordPress Plugin Easy SVG Support versions = 3.7...

WordPress Safe SVG plugin < 2.2.6 - Author+ Cross Site Scripting (XSS) vulnerability

Author+ Cross Site Scripting XSS vulnerability discovered by Alexander Concha in WordPress Plugin Safe SVG versions 2.2.6...

CVE-2024-8378

The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wphandleupload, but not for example for code that uses wphandlesideload which is often used to upload attachments via raw POST data...

CVE-2024-8378

The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wphandleupload, but not for example for code that uses wphandlesideload which is often used to upload attachments via raw POST data...

CVE-2024-8378 Safe SVG < 2.2.6 - Author+ SVG Sanitisation Bypass

The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wphandleupload, but not for example for code that uses wphandlesideload which is often used to upload attachments via raw POST data...

CVE-2024-8378

CVE-2024-8378 relates to the WordPress Safe SVG plugin prior to version 2.2.6. The sanitisation logic only runs for paths that call wp_handle_upload and does not cover code using wp_handle_sideload, which is commonly used to upload attachments via raw POST data. This gap can permit bypass of sani...

CVE-2024-8378 Safe SVG < 2.2.6 - Author+ SVG Sanitisation Bypass

The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wphandleupload, but not for example for code that uses wphandlesideload which is often used to upload attachments via raw POST data...

WordPress plugin Safe SVG 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Easy SVG Support Plugin <= 3.7 is vulnerable to Cross Site Scripting (XSS)

Software Easy SVG Support Type Plugin Vulnerable versions = 3.7 Fixed in 3.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10269 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 74db701b56a6 Credits Francesco Carlucci Require...

WordPress Safe SVG Plugin < 2.2.6 is vulnerable to Cross Site Scripting (XSS)

Software Safe SVG Type Plugin Vulnerable versions 2.2.6 Fixed in 2.2.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-8378 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 6a85e49dfeba Credits Alexander Concha Required privilege Author...

PT-2024-38982 · WordPress · Safe-Svg

Name of the Vulnerable Software and Affected Versions: Safe SVG WordPress plugin versions prior to 2.2.6 Description: The issue arises because the sanitisation code in the Safe SVG WordPress plugin only runs for paths that call wp handle upload, but not for code that uses wp handle sideload, whic...

The vulnerability of the svg_probe function in the libavformat/img2dec.c file of the FFmpeg multimedia library, related to the execution of a loop with an unreachable exit condition, allows a hacker to cause a service failure.

The vulnerability of the svgprobe function in the libavformat/img2dec.c file of the FFmpeg multimedia library relates to the execution of a loop with an unavailable exit condition. Exploiting this vulnerability could allow a malicious actor to cause a service failure by using a specially created...

GHSA-HV6M-QJ65-26Q3 UnoPim Cross-site Scripting vulnerability

UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting XSS in the Create User function. The vulnerability allows attackers to perform XSS in SVG file extension, which can be used to stealing cookies...