CVE-2023-7088 — Add SVG Support for Media Uploader | inventivo <= 1.0.5 - Author+ Stored XSS via SVG

CVE-2023-7088

Add SVG Support for Media Uploader | inventivo <= 1.0.5 - Author+ Stored XSS via SVG PUBLISHED

Description (CNA)

The Add SVG Support for Media Uploader | inventivo WordPress plugin through 1.0.5 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.

Affected (CNA)

Vendor / product	Versions
Unknown / Add SVG Support for Media Uploader \| inventivo	affected 0 through 1.0.5

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/8f515e36-9072-4fc4-9d2f-d50f1adde626/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.