Stored Cross-Site Scripting via SVG File Uploads in Editor Custom Color Palette Plugin for WordPress

CVE-2024-9642

What is CVE-2024-9642?

The Editor Custom Color Palette plugin for WordPress is prone to a Stored Cross-Site Scripting vulnerability that affects all versions up to and including 3.3.7. This flaw arises from inadequate input sanitization and output escaping, enabling authenticated attackers with Author-level access or higher to upload SVG files that contain malicious web scripts. When users access these SVG files, the injected scripts execute, potentially compromising the security and integrity of the web application.

References