Stored Cross-Site Scripting Vulnerability in WP-SVG WordPress Plugin
CVE-2024-11644
Key Information:
- Vendor
- WordPress
- Status
- WP-svg
- Vendor
- CVE Published:
- 27 December 2024
Badges
Summary
The WP-SVG WordPress plugin, used for enhanced SVG functionality within WordPress sites, has a notable security concern in versions up to 0.9. It does not sufficiently validate or escape certain shortcode attributes when rendering them in a page or post. This ineffectiveness enables users with contributor roles and above to execute stored Cross-Site Scripting (XSS) attacks. Such vulnerabilities can lead to the injection of malicious scripts, posing significant security risks to websites utilizing this plugin. Website administrators must ensure timely updates and implement proper security measures to mitigate this risk.
Affected Version(s)
WP-SVG 0 <= 0.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved