Vulnerabilities

TI-2024-03976 CVE-2024-4271 · GHSA-3xp5-7h92-mqvv

SVGator <= 1.2.6 - Stored XSS via SVG Upload

MEDIUM 54

The SVGator WordPress plugin through 1.2.6 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00312 Published 2024-06-14 No fix listed CWE-79

TI-2023-26596 CVE-2023-48766 · GHSA-rqxc-rjhg-cprx

WordPress SVGator – Add Animated SVG Easily Plugin <= 1.2.4 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in SVGator SVGator – Add Animated SVG Easily.This issue affects SVGator – Add Animated SVG Easily: from n/a through 1.2.4.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00272 Published 2023-12-18 No fix listed CWE-352

Vulnerabilities

Filters

SVGator <= 1.2.6 - Stored XSS via SVG Upload

WordPress SVGator – Add Animated SVG Easily Plugin <= 1.2.4 is vulnerable to Cross Site Request Forgery (CSRF)