CVE-2022-1091

The CVE-2022-1091 issue affects the Safe SVG WordPress plugin prior to version 1.9.10. The sanitisation step can be bypassed by spoofing the content-type in a POST request to upload an SVG file, allowing an attacker to perform XSS (and potentially other XML-related attacks depending on the SVG us...

CVE-2024-8378

The Safe SVG WordPress plugin versions prior to 2.2.6 are vulnerable to an Author+ Cross-Site Scripting (XSS) vulnerability. The root cause is a sanitisation bypass where the cleanup code only executes for paths calling wp_handle_upload, failing to cover paths using wp_handle_sideload, which is c...