Lucene search
Mateus Machado TesserWPVDB-ID:91898762-AA7D-4FBC-A016-3DE48901E5DEHistoryJun 23, 2023 - 12:00 a.m.
Enable SVG, WebP & ICO Upload <= 1.0.3 - Author+ Stored XSS
2023-06-2300:00:00
Mateus Machado Tesser
wpscan.com
7
cross-site scripting
stored xss
vulnerability
upload
frontend
sanitize
0.0005 Low
EPSS
Percentile
17.9%
The plugin does not sanitize SVG file contents, leading to a Cross-Site Scripting vulnerability.
PoC
1. Upload an SVG file with the following contents. 2. View the SVG file on the frontend and see the alerts.
| CPE | Name | Operator | Version |
|---|---|---|---|
| enable-svg-webp-ico-upload | eq | * |
Related
prion
prion
Cross site scripting
2023-07-17 14:15:00
wpexploit
wpexploit
Enable SVG, WebP & ICO Upload <= 1.0.3 - Author+ Stored XSS
2023-06-23 00:00:00
cvelist
cvelist
CVE-2023-2143 Enable SVG, WebP & ICO Upload <= 1.0.3 - Author+ Stored XSS
2023-07-17 13:29:52
cve
cve
CVE-2023-2143
2023-07-17 14:15:09
nvd
nvd
CVE-2023-2143
2023-07-17 14:15:09
wordfence
wordfence