WordPress Enable SVG, WebP & ICO Upload plugin <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
CVE-2022-36343

3.4LOW

Key Information:

Vendor: WordPress
Status: Enable Svg, Webp & Ico Upload (WordPress Plugin)
Vendor: CVE Published:; 1 August 2022

What is CVE-2022-36343?

Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress.

Affected Version(s)

Enable SVG, WebP & ICO Upload (WordPress plugin) <= 1.0.1 <= 1.0.1

References

https://patchstack.com/database/vulnerability/enable-svg-...

x_refsource_CONFIRM

https://wordpress.org/plugins/enable-svg-webp-ico-upload/...

x_refsource_CONFIRM

CVSS V3.1

Score:

3.4

Severity:

LOW

Confidentiality:

None

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Aug 1, 2022
Vulnerability Reserved
Jul 22, 2022

Credit

Vulnerability discovered by Kim Jong Min aka Universe (Patchstack Alliance)

JSON