PT-2024-15207 · WordPress · Scalable Vector Graphics

Bob Matyas · Published 2024-03-18 · Updated 2024-08-28 · CVE-2023-7085

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Scalable Vector Graphics (SVG) WordPress plugin versions through 3.4

Description The issue arises from the Scalable Vector Graphics (SVG) WordPress plugin's failure to sanitize uploaded SVG files. This could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.

Recommendations For versions through 3.4, update to a version that sanitizes uploaded SVG files to prevent malicious uploads. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-7085

Affected Products

Scalable Vector Graphics

References · 6

• 🔥 https://wpscan.com/vulnerability/a2ec1308-75a0-49d0-9288-33c6d9ee4328 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-7085 · Security Note
• https://osv.dev/vulnerability/CVE-2023-7085 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1769828835808141678 · Twitter Post
• https://twitter.com/CVEnew/status/1769826036630602003 · Twitter Post
• https://t.me/cvenotify/74181 · Telegram Post