Stored Cross-Site Scripting Vulnerability in King_IE Plugin

CVE-2024-9125

What is CVE-2024-9125?

The King_IE plugin for WordPress contains a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping of SVG file uploads. Authenticated attackers with Author-level access or higher can exploit this flaw to inject malicious web scripts into pages. These scripts are executed when users access the infected SVG files, posing a significant security risk to websites using this plugin. Website administrators must be vigilant and consider updating the plugin to mitigate potential attacks.

References