← CVE Intelligence

CVE-2024-3633

WebP & SVG Support <= 1.4.0 - Author+ Stored XSS via SVG PUBLISHED

Description (CNA)

The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.

Affected (CNA)

Vendor / productVersions
Unknown / WebP & SVG Supportaffected 0 through 1.4.0

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.