Stored Cross-Site Scripting via SVG File uploads in Mime Config plugin

CVE-2024-10017

Summary

The PJW Mime Config plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through SVG file uploads. This issue arises from inadequate input sanitization and output escaping processes present in the plugin. Authenticated users with Author-level access or higher can exploit this vulnerability to inject arbitrary web scripts into pages, compromising user interactions whenever the SVG file is accessed. This security risk underscores the importance of robust input handling mechanisms within WordPress plugins to protect against malicious script injections.

References