Description
The Scalable Vector Graphics (SVG) WordPress plugin through 3.4 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Scalable Vector Graphics (SVG) | ≤ 3.4 | — |
References
- https://wpscan.com/vulnerability/a2ec1308-75a0-49d0-9288-33c6d9ee4328/ exploit vdb-entry technical-description