Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: Allow Svg Files Project Component: Allow Svg Files Clear all filters
TI-2022-02122 CVE-2022-2299 · GHSA-3mrv-3jj9-w487

Allow SVG Files <= 1.1 - Author+ Stored Cross Site Scripting via SVG

Priority LOW 25

The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00624 Published 2022-07-25 No fix listed CWE-79
TI-2022-01798 CVE-2022-1939 · GHSA-8phc-fvf5-9cqv

Allow SVG Files < 1.1 - Admin+ Arbitrary File Upload

Priority LOW 35

The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP files even when they are not allowed to

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01449 Published 2022-06-20 Fixed in 1.1 CWE-434