PT-2025-21377 · WordPress · Add Svg Support For Media Uploader

Bob Matyas · Published 2025-05-15 · Updated 2025-06-12 · CVE-2023-7088

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: The Add SVG Support for Media Uploader | inventivo WordPress plugin versions 1.0.0 through 1.0.5

Description: The issue concerns the failure to sanitize uploaded SVG files, potentially allowing users with a role as low as Author to upload malicious SVG files containing XSS payloads.

Recommendations: For versions 1.0.0 through 1.0.5, consider disabling the SVG upload feature until a patch is available to prevent the upload of malicious SVG files. Restrict access to the media uploader for users with low roles to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-7088

Affected Products

Add Svg Support For Media Uploader

References · 6

• 🔥 https://wpscan.com/vulnerability/8f515e36-9072-4fc4-9d2f-d50f1adde626 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-7088 · Security Note
• https://osv.dev/vulnerability/CVE-2023-7088 · Vendor Advisory
• https://t.me/cvenotify/122731 · Telegram Post
• https://t.me/cvenotify/125485 · Telegram Post
• https://twitter.com/CVEnew/status/1923115381834543318 · Twitter Post