PT-2024-15208 · WordPress · Easy Svg Allow

Bob Matyas · Published 2024-01-29 · Updated 2024-02-03 · CVE-2023-7089

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Easy SVG Allow WordPress plugin version 1.0

Description The issue arises from the plugin's failure to sanitize uploaded SVG files, potentially allowing users with a role as low as Author to upload malicious SVG files containing XSS payloads.

Recommendations For Easy SVG Allow WordPress plugin version 1.0, consider disabling the SVG upload feature until a patch is available to prevent potential exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-7089

Affected Products

Easy Svg Allow

References · 3

• 🔥 https://wpscan.com/vulnerability/3b8ba734-7764-4ab6-a7e2-8de55bd46bed · Exploit
• https://osv.dev/vulnerability/CVE-2023-7089 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-7089 · Security Note