Stored Cross-Site Scripting Vulnerability in WordPress Plugin

CVE-2024-8917

What is CVE-2024-8917?

The AnWP Football Leagues plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability via SVG file uploads, primarily due to the lack of proper input sanitization and output escaping in versions up to 0.16.7. This vulnerability allows authenticated users with Author-level access or higher to inject malicious web scripts into the pages hosting the SVG files. As a result, whenever a user accesses these SVG files, the injected scripts execute, potentially compromising the security and integrity of user sessions and data.

References