Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
wpvulndbBob MatyasWPVDB-ID:8F515E36-9072-4FC4-9D2F-D50F1ADDE626
HistoryJan 23, 2024 - 12:00 a.m.

Add SVG Support for Media Uploader | inventivo <= 1.0.5 - Author+ Stored XSS via SVG

2024-01-2300:00:00
Bob Matyas
wpscan.com
4
svg
media uploader
stored xss
author role

AI Score

9.1

Confidence

High

JSON

Description The plugin does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.

PoC

Upload an SVG with the following code: Access the uploaded file directly to see the XSS.

Related

wpexploit 1
wordfence 1
wpexploit
wpexploit
Add SVG Support for Media Uploader | inventivo <= 1.0.5 - Author+ Stored XSS via SVG
2024-01-23 00:00:00
wordfence
wordfence
Wordfence Intelligence Weekly WordPress Vulnerability Report (January 22, 2024 to January 28, 2024)
2024-02-01 15:49:51

AI Score

9.1

Confidence

High

JSON
Related for WPVDB-ID:8F515E36-9072-4FC4-9D2F-D50F1ADDE626
wpexploit1wordfence1