CVE-2024-8964: Image Optimizer, Resizer and CDN – Sirv <= 7.2.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 7.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8964?
CVE-2024-8964 is rated as a medium severity vulnerability due to the potential for stored cross-site scripting attacks affecting WordPress users.
How do I fix CVE-2024-8964?
To fix CVE-2024-8964, update the Sirv plugin for WordPress to version 7.3.0 or later, which includes necessary security patches.
Who is affected by CVE-2024-8964?
All users of the Sirv Image Optimizer, Resizer and CDN plugin for WordPress up to and including version 7.2.9 are affected by CVE-2024-8964.
What types of attacks are possible with CVE-2024-8964?
CVE-2024-8964 enables authenticated attackers to perform stored cross-site scripting (XSS) attacks via SVG file uploads.
What versions of the Sirv plugin are vulnerable to CVE-2024-8964?
All versions of the Sirv Image Optimizer, Resizer and CDN plugin up to and including 7.2.9 are vulnerable to CVE-2024-8964.