Stored Cross-Site Scripting in SVG Support Plugin for WordPress

CVE-2024-10222

What is CVE-2024-10222?

The SVG Support plugin for WordPress is susceptible to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping during SVG file uploads. Authenticated attackers with Author-level access or higher can exploit this vulnerability to inject malicious scripts that execute when users access the affected SVG file. While typically only administrators can upload SVG files, permission to do so can be extended to authors, increasing the risk of exploitation for WordPress sites using this plugin.

References