CVE-2021-24386 WP SVG Images < 3.4 - Authenticated (author+) Stored XSS via SVG

The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ to upload a malicious SVG and then perform XSS attacks by inducing another user to access the file directly. In v3.4, the plugin restricted such upload to...