Stored Cross-Site Scripting Vulnerability in Logo Showcase Ultimate

CVE-2024-8046

Summary

The Logo Showcase Ultimate plugin for WordPress is exposed to a vulnerability that enables Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. This issue arises from the handling of SVG file uploads, which allows an attacker with Author-level access or higher to embed malicious scripts within the SVG files. Such scripts will execute when users access the compromised SVG files, leading to potential security breaches and unauthorized access to user sessions or sensitive data. Website administrators should ensure that they update to the latest version of the plugin and review access controls to mitigate this risk.

References