PT-2024-38982 · WordPress · Safe-Svg

Alexander Concha + 1 · Published 2024-11-07 · Updated 2025-05-17 · CVE-2024-8378

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Safe SVG WordPress plugin versions prior to 2.2.6

Description: The issue arises because the sanitisation code in the Safe SVG WordPress plugin only runs for paths that call wp handle upload, but not for code that uses wp handle sideload, which is often used to upload attachments via raw POST data. This can lead to potential security risks, including cross-site scripting (XSS) attacks.

Recommendations: For Safe SVG WordPress plugin versions prior to 2.2.6, upgrade to version 2.2.6 or later to mitigate the risks associated with this issue. As a temporary workaround, consider restricting the use of wp handle sideload until the plugin is updated.

Exploit

Fix

Related Identifiers

CVE-2024-8378

Affected Products

Safe-Svg

References · 8

• 🔥 https://wpscan.com/vulnerability/17be4bf2-486d-43ab-b87a-2117c8d77ca8 · Exploit
• https://osv.dev/vulnerability/CVE-2024-8378 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8378 · Security Note
• https://twitter.com/oktsec/status/1854564029877903465 · Twitter Post
• https://t.me/cvedetector/10095 · Telegram Post
• https://twitter.com/CVEnew/status/1854547505683255676 · Twitter Post
• https://t.me/cvenotify/122700 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1854624252906889711 · Twitter Post