Stored Cross-Site Scripting (CSS) Vulnerability in Inline SVG Plugin

CVE-2024-9064

Summary

The Elementor Inline SVG plugin for WordPress contains a vulnerability that allows authenticated users with adequate permissions to perform Stored Cross-Site Scripting (XSS). This issue arises from inadequate input sanitization and output escaping for SVG file uploads. As a result, attackers can inject arbitrary script content into web pages, which executes in the context of users accessing those SVG files. All versions of the plugin up to and including 1.2.0 are impacted, presenting a significant risk to website integrity and user safety.

References