CVE-2024-4272

The Support SVG WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions before 1.1.0 . The root cause is a failure to sanitize the contents of uploaded SVG files. This allows users with at least the author role to upload SVG files containing malicious JavaScript, which can...