Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2024-9060

AVIF & SVG Uploader <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The AVIF & SVG Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in version 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Grandplugins Wordpress
Products
Avif Uploader Wordpress
CVE-2024-9238

AVIF & SVG Uploader <= 1.1.0 - Author+ Stored XSS via SVG Uplaod

The AVIF Uploader WordPress plugin before 1.1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Grandplugins
Products
Avif Uploader