Description
The Add SVG Support for Media Uploader | inventivo WordPress plugin through 1.0.5 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Add SVG Support for Media Uploader | inventivo | ≤ 1.0.5 | — |
References
- https://wpscan.com/vulnerability/8f515e36-9072-4fc4-9d2f-d50f1adde626/ exploit vdb-entry technical-description