CVE-2024-10482: Media Library Tools < 1.5.0 - Author+ Stored XSS via SVG
Published Nov 21, 2024
·Updated
The Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO WordPress plugin before 1.5.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Affected Software
6 affected components
WordPress Media File Rename<1.5.0
WordPress Find Unused File<1.5.0
WordPress Add Alt text<1.5.0
WordPress Caption<1.5.0
WordPress Desc For Image SEO<1.5.0
Wptinysolutions Media Library Tools Wordpress<1.5.0
Event History
Nov 21, 2024
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·11:15 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2024-10482?
CVE-2024-10482 has a moderate severity level due to its potential for XSS attacks via malformed SVG uploads.
2
How do I fix CVE-2024-10482?
To fix CVE-2024-10482, update the affected WordPress plugins to version 1.5.0 or later.
3
Which versions of the WordPress plugins are affected by CVE-2024-10482?
CVE-2024-10482 affects versions of the WordPress plugins prior to 1.5.0.
4
What type of attack does CVE-2024-10482 enable?
CVE-2024-10482 enables cross-site scripting (XSS) attacks through unvalidated SVG file uploads.
5
Who can exploit CVE-2024-10482?
CVE-2024-10482 can be exploited by users with a role as low as Author on the affected WordPress sites.