PT-2025-12856 · WordPress · Wp-Svg-Upload

Pierre Rudloff · Published 2025-03-26 · Updated 2025-03-26 · CVE-2024-11847

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions wp-svg-upload WordPress plugin version 1.0.0

Description The issue concerns the wp-svg-upload WordPress plugin, which does not sanitize SVG file contents. This enables users with at least the author role to upload SVG files with malicious JavaScript, allowing them to conduct Stored XSS attacks.

Recommendations For version 1.0.0, consider disabling the ability to upload SVG files until a patch is available to prevent Stored XSS attacks. Restrict access to the plugin's functionality for users with the author role and below to minimize the risk of exploitation. Avoid using the plugin to upload SVG files with JavaScript content until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-11847

GHSA-V2RR-FHV8-MX74

Affected Products

Wp-Svg-Upload

References · 10

• 🔥 https://wpscan.com/vulnerability/f57ecff2-0cff-40c7-b6e4-5b162b847d65 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-11847 · Security Note
• https://osv.dev/vulnerability/GHSA-v2rr-fhv8-mx74 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-11847 · Vendor Advisory
• https://github.com/digimix/wp-svg-upload · Note
• https://t.me/cvenotify/116274 · Telegram Post
• https://twitter.com/CVEnew/status/1904787204993405440 · Twitter Post
• https://t.me/cvetracker/19933 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1904788772077601085 · Twitter Post
• https://t.me/cvedetector/21150 · Telegram Post