PT-2025-1629 · WordPress · Wp-Enable-Svg

Pierre Rudloff · Published 2025-01-02 · Updated 2025-06-24 · CVE-2024-11184

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions wp-enable-svg WordPress plugin versions 0.7 and earlier wp-enable-svg WordPress plugin versions 0.2 and earlier

Description The issue is related to the wp-enable-svg WordPress plugin, which does not sanitize SVG files when uploaded. This allows authors and above to upload SVGs containing malicious scripts.

Recommendations For versions 0.7 and earlier, consider disabling SVG upload functionality until a patch is available. For versions 0.2 and earlier, consider disabling SVG upload functionality until a patch is available. As a temporary workaround, consider restricting access to the SVG upload feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-11184

GHSA-J77F-79W9-RGHC

Affected Products

Wp-Enable-Svg

References · 10

• 🔥 https://wpscan.com/vulnerability/fc982bcb-9974-481f-aef4-580ae9edc3c8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-11184 · Security Note
• https://osv.dev/vulnerability/GHSA-j77f-79w9-rghc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-11184 · Vendor Advisory
• https://twitter.com/CVEnew/status/1874701932142420198 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1874708810058654000 · Twitter Post
• https://t.me/cvedetector/14096 · Telegram Post
• https://github.com/MWDelaney/wp-enable-svg · Note
• https://t.me/cvenotify/126430 · Telegram Post
• https://t.me/cvenotify/105940 · Telegram Post