Description
The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | wp-enable-svg | ≤ 0.7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | mwdelaney/wp-enable-svg | <= 0.2 | — | GHSA-j77f-79w9-rghc |
References
- https://wpscan.com/vulnerability/fc982bcb-9974-481f-aef4-580ae9edc3c8/ exploit vdb-entry technical-description