Description
The SVG Uploads Support WordPress plugin through 2.1.1 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | SVG Uploads Support | ≤ 2.1.1 | — |
References
- https://wpscan.com/vulnerability/94954e1a-dc09-4811-b57d-b12bf69a767d/ exploit vdb-entry technical-description