11102 matches found
CVE-2024-4759
The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...
CVE-2024-4759 Mime Types Extended <= 0.11 - Author+ Stored XSS via SVG Upload
The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...
CVE-2024-4759
CVE-2024-4759 affects the Mime Types Extended WordPress plugin (versions up to 0.11). The issue is that SVG uploads are not sanitised, enabling a stored XSS payload via SVG files by users with as little as Author privileges. Public sources in the connected documents corroborate an Author+ XSS ris...
CVE-2024-4759 Mime Types Extended <= 0.11 - Author+ Stored XSS via SVG Upload
The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...
PT-2024-32665 · WordPress · Mime Types Extended
Name of the Vulnerable Software and Affected Versions: Mime Types Extended WordPress plugin versions through 0.11 Description: The issue concerns the Mime Types Extended WordPress plugin, which fails to sanitize uploaded SVG files. This could allow users with a role as low as Author to upload...
CVE-2024-34452
CMSimpleXH 1.7.6 allows XSS by uploading a crafted SVG document...
CVE-2024-5945
The WP SVG Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 4.3 due to insufficient input sanitization. This makes it possible for authenticated attackers, with Author-level access and above, who have permissio...
CVE-2024-5945 WP SVG Images <= 4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
The WP SVG Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 4.3 due to insufficient input sanitization. This makes it possible for authenticated attackers, with Author-level access and above, who have permissio...
CVE-2024-5945
CVE-2024-5945 affects the WP SVG Images WordPress plugin, with stored XSS via the type parameter in all versions up to 4.2 due to insufficient input sanitization. Exploitation requires authentication (Author-level access or higher) and permissions to upload sanitized files. Successful abuse could...
CVE-2024-5945 WP SVG Images <= 4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
The WP SVG Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 4.3 due to insufficient input sanitization. This makes it possible for authenticated attackers, with Author-level access and above, who have permissio...
CVE-2024-5191 Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.17 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mimetypes’ parameter in all versions up to, and including, 3.4.17 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2024-34452
CMSimpleXH 1.7.6 allows XSS by uploading a crafted SVG document...
CVE-2024-34452
CMSimple_XH 1.7.6 is affected by CVE-2024-34452, enabling cross-site scripting through uploading a crafted SVG document. Multiple sources describe the issue as a lack of proper filtering/escaping of user input in SVG uploads, leading to XSS in CMSimple_XH. The affected product is a PHP-based CMS....
CVE-2024-34452
CMSimpleXH 1.7.6 allows XSS by uploading a crafted SVG document...
CVE-2024-34452
CMSimpleXH 1.7.6 allows XSS by uploading a crafted SVG document...
PT-2024-5242 · Roundup · Roundup
Name of the Vulnerable Software and Affected Versions: Roundup versions prior to 2.4.0 Description: The issue is related to the lack of protection of the web page structure in the Roundup error tracking system. This allows a remote attacker to conduct cross-site scripting attacks by uploading...
WordPress WP SVG images Plugin <= 4.2 is vulnerable to Cross Site Scripting (XSS)
Software WP SVG images Type Plugin Vulnerable versions = 4.2 Fixed in 4.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5945 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8b632fc271b3 Credits Colin Xu Required privilege...
ROS-20240618-01
A vulnerability in the SVG Handler component of the RoundCube email client is related to cross-site scripting attacks. Exploitation of the vulnerability could allow an attacker acting remotely to exploit XSS via the SVG animation attributes. Vulnerability in the User Preferences Handler component...
CVE-2024-4271
The SVGator WordPress plugin through 1.2.6 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks...
CVE-2024-4270
CVE-2024-4270 — SVGMagic WordPress plugin (<= 1.1) The vulnerability stems from the plugin not sanitizing SVG file contents, enabling an attacker with at least the author role to upload SVGs containing malicious JavaScript that can trigger Stored XSS. The issue is rooted in insufficient input ...