Read the docs

Allow Svg Files Project

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Allow Svg Files Project records in CISA KEV

No Allow Svg Files Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Allow Svg Files 2 records LOW

Records

2 records

TI-2022-01798 CVE-2022-1939 · GHSA-8phc-fvf5-9cqv

Allow SVG Files < 1.1 - Admin+ Arbitrary File Upload

Priority LOW 35

The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP files even when they are not allowed to

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01449 Published 2022-06-20 Fixed in 1.1 CWE-434
TI-2022-02122 CVE-2022-2299 · GHSA-3mrv-3jj9-w487

Allow SVG Files <= 1.1 - Author+ Stored Cross Site Scripting via SVG

Priority LOW 25

The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00624 Published 2022-07-25 No fix listed CWE-79
Open these records in search →