GHSA-v2rr-fhv8-mx74

Source

https://github.com/advisories/GHSA-v2rr-fhv8-mx74

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-v2rr-fhv8-mx74/GHSA-v2rr-fhv8-mx74.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-v2rr-fhv8-mx74

Aliases

CVE-2024-11847

Published

2025-03-26T06:31:37Z

Modified

2025-04-01T21:27:07.939092Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

wp-svg-upload WordPress plugin vulnerable to Stored Cross-site Scripting

Details

The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.

Database specific

{
    "nvd_published_at": "2025-03-26T06:15:28Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-01T20:59:13Z"
}

References

Affected packages

Packagist / digimix/wp-svg-upload

Package

Name: digimix/wp-svg-upload
Purl: pkg:composer/digimix/wp-svg-upload

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.0.0