Description
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Kirki | 6.0.0 – < 6.3.1 | 6.3.1 |
References
- https://wpscan.com/vulnerability/02ed6d31-84f3-4723-8b49-ddb00c7db7d3/ exploit vdb-entry technical-description