CVE-2022-1091

The CVE-2022-1091 issue affects the Safe SVG WordPress plugin prior to version 1.9.10. The sanitisation step can be bypassed by spoofing the content-type in a POST request to upload an SVG file, allowing an attacker to perform XSS (and potentially other XML-related attacks depending on the SVG us...

CVE-2024-8378

The Safe SVG WordPress plugin (versions prior to 2.2.6 ) is vulnerable to Cross-Site Scripting (XSS) . The root cause is an incomplete sanitisation logic where security cleanup code only executes for paths calling wp_handle_upload, failing to cover wp_handle_sideload, which is commonly used for u...