Description
The Enable SVG Uploads WordPress plugin through 2.1.5 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Enable SVG Uploads | ≤ 2.1.5 | — |
References
- https://wpscan.com/vulnerability/4ac03907-2373-48f0-bca1-8f7073c06b18 exploit vdb-entry technical-description