Stored Cross-Site Scripting (XSS) vulnerability in WordPress via SVG File uploads

CVE-2024-9443

What is CVE-2024-9443?

The Basticom Framework plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping when processing SVG file uploads. Authenticated users with Author-level access and above can exploit this weakness to inject and execute arbitrary web scripts within the content. This vulnerability poses a significant risk as it enables attackers to manipulate user sessions and potentially gain unauthorized access to sensitive data when users view the affected SVG files. Proper updates and security measures are essential to mitigate risk.

References