CVE-2022-34648

Authenticated author+ Stored Cross-Site Scripting XSS vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin = 1.0.1 at WordPress...

CVE-2022-34648

The CVE-2022-34648 entry affects the dmitrylitvinov Uploading SVG, WEBP and ICO files plugin for WordPress (versions ≤ 1.0.1). The root cause is an authenticated Stored XSS vulnerability introduced by allowing upload of SVG, WEBP, and ICO files; an author+ user can trigger stored scripts, leading...

PT-2022-23291 · WordPress · Dmitrylitvinov Uploading Svg

Name of the Vulnerable Software and Affected Versions: dmitrylitvinov Uploading SVG, WEBP and ICO files plugin version 1.0.1 and earlier Description: The issue concerns an Authenticated Arbitrary File Upload vulnerability. This allows attackers to upload malicious files to the system, potentially...