Vulnerabilities

TI-2023-04118 CVE-2023-4460 · GHSA-5w5f-8x6p-gxf4

Uploading SVG, WEBP and ICO files <= 1.2.1 - Author+ Stored XSS via SVG

MEDIUM 60

The Uploading SVG, WEBP and ICO files WordPress plugin through 1.2.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01045 Published 2023-12-04 No fix listed CWE-79

TI-2022-16641 CVE-2022-36285 · GHSA-m4f7-3v98-hpxx

WordPress Uploading SVG, WEBP and ICO files plugin <= 1.0.1 - Authenticated Arbitrary File Upload vulnerability

LOW 36

Authenticated Arbitrary File Upload vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01209 Published 2022-08-23 No fix listed CWE-434

TI-2022-15469 CVE-2022-34648 · GHSA-cmqg-5hgq-7vq9

Cross-site scripting in dmitrylitvinov Uploading SVG, WEBP and ICO files

LOW 25

Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00572 Published 2022-08-23 No fix listed CWE-79

Vulnerabilities

Filters

Uploading SVG, WEBP and ICO files <= 1.2.1 - Author+ Stored XSS via SVG

WordPress Uploading SVG, WEBP and ICO files plugin <= 1.0.1 - Authenticated Arbitrary File Upload vulnerability

Cross-site scripting in dmitrylitvinov Uploading SVG, WEBP and ICO files