CVE-2022-1964CWE-79

Easy SVG Support < 3.3.0 - Author+ Stored Cross Site Scripting via SVG

published June 27, 2022

CVSS
—
EPSS
1%
Percentile
47.7
In the wild
Unconfirmed
What it is

The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00595 · 47.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-06-27T08:58Z
EPSS history
Timeline
  • 27 JUN 08:58Z
    Easy SVG Support < 3.3.0 - Author+ Stored Cross Site Scripting via SVG
    cvelistv5