CVE-2024-9172

CVE-2024-9172 affects the WordPress plugin Demo Importer Plus. It allows Stored Cross-Site Scripting via SVG uploads in all versions up to 2.0.1. Exploitation requires an authenticated attacker with Author+ privileges, who can inject script into pages that execute when users view the SVG file. Th...