WordPress Safe SVG Plugin < 2.2.6 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:safesvgproject:safesvg"; ifdescription...

CVE-2024-8378

The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wphandleupload, but not for example for code that uses wphandlesideload which is often used to upload attachments via raw POST data...

CVE-2024-8378

The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wphandleupload, but not for example for code that uses wphandlesideload which is often used to upload attachments via raw POST data...

CVE-2024-8378

creationtimestamp| type| source ---|---|--- 2024-11-07 15:18:55+00:00| seen| https://infosec.exchange/users/cve/statuses/113442339897397248 2024-11-07 17:46:18+00:00| seen| https://t.me/cvedetector/10095...

CVE-2024-8378 Safe SVG < 2.2.6 - Author+ SVG Sanitisation Bypass

The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wphandleupload, but not for example for code that uses wphandlesideload which is often used to upload attachments via raw POST data...

CVE-2024-8378

The Safe SVG WordPress plugin (versions prior to 2.2.6 ) is vulnerable to Cross-Site Scripting (XSS) . The root cause is an incomplete sanitisation logic where security cleanup code only executes for paths calling wp_handle_upload, failing to cover wp_handle_sideload, which is commonly used for u...

CVE-2024-8378 Safe SVG < 2.2.6 - Author+ SVG Sanitisation Bypass

The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wphandleupload, but not for example for code that uses wphandlesideload which is often used to upload attachments via raw POST data...