CVE-2024-5892: Divi Torque Lite – Divi Theme and Extra Theme <= 3.6.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
The Divi Torque Lite – Divi Theme and Extra Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘supportunfilteredfilesupload’ function in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5892?
CVE-2024-5892 is classified as a high severity vulnerability due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2024-5892?
To fix CVE-2024-5892, update the Divi Torque Lite, Divi Theme, or Extra Theme plugin to version 4.0.0 or later.
What type of vulnerability is CVE-2024-5892?
CVE-2024-5892 is a Stored Cross-Site Scripting (XSS) vulnerability.
Which versions are affected by CVE-2024-5892?
CVE-2024-5892 affects all versions of the Divi Torque Lite, Divi Theme, and Extra Theme plugins up to and including version 3.6.6.
Who is the vendor of the software affected by CVE-2024-5892?
The vendor of the affected software is Elegant Themes.