Read the docs
TI-2021-06678 Aliases CVE-2021-24386GHSA-9qvq-vg28-xrq7

WP SVG Images < 3.4 - Authenticated (author+) Stored XSS via SVG

Priority LOW 25CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ to upload a malicious SVG and then perform XSS attacks by inducing another user to access the file directly. In v3.4, the plugin restricted such upload to editors and admin, with an option to also allow author to do so. The description of the plugin has also been updated with a security warning as upload of such content is intended.

Why it matters now

EPSS 0.00659 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed WP SVG images (KubiQ): 3.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
KubiQWP SVG images3.4 to before 3.43.4Patch availableCNA
  • WP SVG images VendorKubiQ Affected 3.4 to before 3.4 Fixed in 3.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kubiq:wp_svg_images:*:*:*:*:*:wordpress:*:*before 3.4VulnerableKubiQ
  • cpe:2.3:a:kubiq:wp_svg_images:*:*:*:*:*:wordpress:*:* Versions before 3.4 Vulnerable ·KubiQ

Remediation

  • Fix · CNA WP SVG images (KubiQ) Fixed in 3.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24386
  2. 2026-10-03 Alias added: GHSA-9qvq-vg28-xrq7
  3. 2026-10-09 EPSS moved to the 50th–90th percentile

References

Exploit 1

  • TI-2024-05509 WP SVG Images <= 4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG CVSS 3.1MEDIUM 6.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences