CVE-2024-10016: File Upload Types by WPForms <= 1.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
The File Upload Types by WPForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10016?
CVE-2024-10016 has a high severity due to the risk of stored cross-site scripting (XSS) attacks.
How do I fix CVE-2024-10016?
To fix CVE-2024-10016, update the File Upload Types by WPForms plugin to a version greater than 1.4.0.
What is the impact of CVE-2024-10016?
The impact of CVE-2024-10016 allows authenticated attackers to inject malicious scripts through improperly handled SVG file uploads.
Are all versions of the File Upload Types by WPForms plugin affected by CVE-2024-10016?
Yes, all versions up to and including 1.4.0 of the File Upload Types by WPForms plugin are affected by CVE-2024-10016.
Who is vulnerable to CVE-2024-10016?
Authenticated users with upload permissions are vulnerable to CVE-2024-10016 if they are using affected versions of the plugin.