Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2022-2299

Allow SVG Files <= 1.1 - Author+ Stored Cross Site Scripting via SVG

The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Allow Svg Files Project
Products
Allow Svg Files
CVE-2022-1939

Allow SVG Files < 1.1 - Admin+ Arbitrary File Upload

The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP files even when they are not allowed to

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Allow Svg Files Project
Products
Allow Svg Files