CVE-2021-24386

The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ to upload a malicious SVG and then perform XSS attacks by inducing another user to access the file directly. In v3.4, the plugin restricted such upload to...

Design/Logic Flaw

The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ to upload a malicious SVG and then perform XSS attacks by inducing another user to access the file directly. In v3.4, the plugin restricted such upload to...

CVE-2021-24386

CVE-2021-24386 affects the WordPress WP SVG Images plugin prior to version 3.4. The vulnerability arises from insufficient sanitisation of uploaded SVG files, enabling low-privilege users (e.g., author+) to upload a malicious SVG and trigger stored XSS when other users access the file. Multiple c...

CVE-2021-24386 WP SVG Images < 3.4 - Authenticated (author+) Stored XSS via SVG

The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ to upload a malicious SVG and then perform XSS attacks by inducing another user to access the file directly. In v3.4, the plugin restricted such upload to...

CVE-2021-24386: Improper Neutralization of Input During Web Page Generation

The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ to upload a malicious SVG and then perform XSS attacks by inducing another user to access the file directly. In v3.4, the plugin restricted such upload to...

CVE-2019-14216: Cross-Site Request Forgery (CSRF)

An issue was discovered in the svg-vector-icon-plugin aka WP SVG Icons plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg-icons-custom-set mishandles Custom Icon uploads. CSRF leads to upload of a ZIP archive containing a .php file...