PT-2024-17152 · WordPress · Wp-Svg

Bob Matyas · Published 2024-12-27 · Updated 2025-05-14 · CVE-2024-11644

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WP-SVG WordPress plugin versions 0.9 and prior

Description The issue concerns the WP-SVG WordPress plugin, which does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded. This could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Recommendations For WP-SVG WordPress plugin versions 0.9 and prior, as a temporary workaround, consider disabling the use of shortcode attributes until a patch is available. Restrict access to the plugin's functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-11644

Affected Products

Wp-Svg

References · 11

• 🔥 https://wpscan.com/vulnerability/5b6a80f1-369c-4dd2-877e-60b724084819 · Exploit
• https://osv.dev/vulnerability/CVE-2024-11644 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11644 · Security Note
• https://t.me/cvenotify/105641 · Telegram Post
• https://twitter.com/Hossted_OSS/status/1876153375898861707 · Twitter Post
• https://twitter.com/CVEnew/status/1872527577513947466 · Twitter Post
• https://t.me/cvedetector/13717 · Telegram Post
• https://twitter.com/Hossted_OSS/status/1876306152545481152 · Twitter Post
• https://t.me/cvenotify/105570 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1872544139243299310 · Twitter Post
• https://t.me/cvenotify/122120 · Telegram Post