CVE-2022-1562CWE-79

Enable SVG < 1.4.0 - Author+ Stored Cross Site Scripting via SVG

published May 30, 2022

CVSS
—
EPSS
1%
Percentile
48.2
In the wild
Unconfirmed
What it is

The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00604 · 48.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-05-30T08:35Z
EPSS history
Timeline
  • 30 MAY 08:35Z
    Enable SVG < 1.4.0 - Author+ Stored Cross Site Scripting via SVG
    cvelistv5