Medium · 6.5 CVE-2024-12163 EUVD-2024-50640GHSA-65f9-48qm-g2v2

GoodLayers Core < 2.1.3 - Subscriber+ Stored XSS via SVG Upload

Published Jan 30, 2025 · Updated Jan 30, 2025 · Assigned by WPScan

Description

The goodlayers-core WordPress plugin before 2.1.3 allows users with a subscriber role and above to upload SVGs containing malicious payloads.

Vendor	Product	Affected	Fixed
—	goodlayers-core	< 2.1.3	2.1.3