CVE-2024-13708 Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Stored Cross-Site Scripting

The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in versions 4.0.1 to 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVE-2024-13708 Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Stored Cross-Site Scripting

The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in versions 4.0.1 to 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVE-2024-13708

Booster for WooCommerce (WordPress) is affected by an unauthenticated stored XSS via SVG uploads in versions 4.0.1–7.2.4 due to insufficient input sanitization and output escaping. The issue can allow arbitrary script execution in pages when SVGs are loaded by users. Wordfence notes the vulnerabi...

DoWISP operating system command injection vulnerability

DoWISP is a full-service cloud-based management software for Internet Service Providers ISPs from DoWISP, Inc. An operating system command injection vulnerability exists in DoWISP versions prior to 1.16.2.50, which stems from the fact that uploading a malicious profile picture in SVG format can...

PT-2025-14845

Name of the Vulnerable Software and Affected Versions Booster for WooCommerce plugin for WordPress versions 4.0.1 through 7.2.4 Description The issue is related to Stored Cross-Site Scripting via SVG file uploads, which is possible due to insufficient input sanitization and output escaping. This...

CVE-2025-3189: Improper Neutralization of Special Elements used in an OS Command

Stored Cross-Site Scripting XSS in DoWISP in versions prior to 1.16.2.50, which consists of an stored XSS through the upload of a profile picture in SVG format with malicious Javascript code in it...

CVE-2024-13708: Unrestricted Upload of File with Dangerous Type

The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in versions 4.0.1 to 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

BIT-JOOMLA-2022-23801 [20220309] - Core - XSS attack vector through SVG

An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in commedia...

PT-2025-14784 · Dowisp · Dowisp

Name of the Vulnerable Software and Affected Versions: DoWISP versions prior to 1.16.2.50 Description: The issue is related to a Stored Cross-Site Scripting XSS in DoWISP, where an attacker can upload a profile picture in SVG format containing malicious JavaScript code, leading to the execution o...

CVE-2025-2513

The Smart Icons For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access...

CVE-2025-2513

CVE-2025-2513 concerns the WordPress plugin Smart Icons For WordPress. The connected Wordfence entry confirms a Stored Cross-Site Scripting (XSS) flaw via SVG file uploads in all versions up to 1.0.4, caused by insufficient input sanitization and lack of proper output escaping. The impact is that...

CVE-2025-2513 Smart Icons For WordPress <= 1.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Smart Icons For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access...

CVE-2025-2513 Smart Icons For WordPress <= 1.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Smart Icons For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access...

PT-2025-14473 · WordPress · Smart Icons For Wordpress

Name of the Vulnerable Software and Affected Versions: The Smart Icons For WordPress plugin for WordPress versions up to, and including, 1.0.4 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This...

CVE-2025-2513: Improper Neutralization of Input During Web Page Generation

The Smart Icons For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access...

CVE-2024-11847

The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks...

CVE-2025-2576

The Ayyash Studio — The kick-start kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...

CVE-2025-2573

The Amazing service box Addons For WPBakery Page Builder formerly Visual Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2025-2542

The Your Simple SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access a...

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: CVE-2024-44192: Fixed unexpected process crash due to processing maliciously crafted web content bsc1239863 CVE-2024-54467: Fixed data exilfration cross-origin due to a cookie management issue via a malicious website bsc1239864 Other fixes: ...