CVE-2022-1562 — Enable SVG < 1.4.0 - Author+ Stored Cross Site Scripting via SVG

CVE-2022-1562

Enable SVG < 1.4.0 - Author+ Stored Cross Site Scripting via SVG PUBLISHED

Description (CNA)

The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads

Affected (CNA)

Vendor / product	Versions
Unknown / Enable SVG	affected 1.4.0 before 1.4.0

CWE

CWE-79

References

https://wpscan.com/vulnerability/8e5b1e4f-c132-42ee-b2d0-7306ab4ab615

ADP enrichment

CVE

No English description supplied.

https://wpscan.com/vulnerability/8e5b1e4f-c132-42ee-b2d0-7306ab4ab615