CVE-2024-11184: WP Enabled SVG <= 0.7 - Author+ Stored XSS via SVG
The wp-enable-svg WordPress plugin through 0.2 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts
Other sources
The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11184?
CVE-2024-11184 has a medium severity due to its potential for remote code execution through unfiltered SVG uploads.
How do I fix CVE-2024-11184?
To fix CVE-2024-11184, update the wp-enable-svg WordPress plugin to version 0.3 or higher.
Which versions are affected by CVE-2024-11184?
Versions up to and including 0.2 of the wp-enable-svg WordPress plugin are affected by CVE-2024-11184.
Can all users upload SVG files with CVE-2024-11184?
Yes, users with author roles and above can upload SVG files, which may contain malicious scripts as per CVE-2024-11184.
What type of vulnerability is CVE-2024-11184?
CVE-2024-11184 is a file upload vulnerability that allows the execution of malicious scripts through unauthenticated SVG uploads.