Stored Cross-Site Scripting (XSS) Vulnerability in The Image Optimizer Resizer and CDN – Sirv plugin for WordPress
CVE-2024-8964

6.4MEDIUM

Key Information:

Vendor
Sirv
Status
Image Optimizer, Resizer And Cdn – Sirv
Vendor
CVE Published:
8 October 2024

Summary

The Sirv plugin for WordPress is susceptible to a Stored Cross-Site Scripting attack through SVG file uploads. This vulnerability stems from inadequate input sanitization and output escaping protocols implemented in the plugin, exposing websites to potential exploitation. Authenticated users with Author-level access or higher can inject malicious web scripts that execute whenever a user accesses the compromised SVG file. Thus, it's crucial for website administrators to ensure their Sirv plugin is updated to the latest version to mitigate the risks associated with this vulnerability.

Affected Version(s)

Image Optimizer, Resizer and CDN – Sirv * <= 7.2.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/sirv/#developers
https://plugins.trac.wordpress.org/changeset/3162079/

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
.