Show filters
13 Total Results
Displaying 11-13 of 13
Sort by:
Attacker Value
Unknown
CVE-2022-1755
Disclosure Date: September 26, 2022 (last updated October 08, 2023)
The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with a role as low as author to perform Cross-Site Scripting attacks
0
Attacker Value
Unknown
CVE-2022-1964
Disclosure Date: June 27, 2022 (last updated October 07, 2023)
The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads
0
Attacker Value
Unknown
CVE-2021-24686
Disclosure Date: February 01, 2022 (last updated February 23, 2025)
The SVG Support WordPress plugin before 2.3.20 does not escape the "CSS Class to target" setting before outputting it in an attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
0
