CVE-2024-9238

The AVIF Uploader WordPress plugin (versions prior to 1.1.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to properly sanitize uploaded SVG files . An attacker with a role as low as Author can exploit this by uploading a malicious SVG containing an XSS payload. To remediat...