CVE-2022-2299CWE-79

Allow SVG Files <= 1.1 - Author+ Stored Cross Site Scripting via SVG

published July 25, 2022

CVSS
—
EPSS
1%
Percentile
49.2
In the wild
Unconfirmed
What it is

The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00624 · 49.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-07-25T12:48Z
EPSS history
Timeline
  • 25 JUL 12:48Z
    Allow SVG Files <= 1.1 - Author+ Stored Cross Site Scripting via SVG
    cvelistv5