CVE-2024-9238

CVE-2024-9238 covers the WordPress plugin AVIF Uploader, where versions before 1.1.1 fail to sanitize uploaded SVGs, allowing an attacker with as little as Author privileges to inject XSS via an SVG file. Multiple connected sources confirm the vulnerability pattern (SVG sanitization bypass and st...