CVE-2022-2299

Allow SVG Files <= 1.1 - Author+ Stored Cross Site Scripting via SVG

EPSS 0.5%CWE-79

Vexday Risk Score

3Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS —EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

25 jul 2022Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads

Produtos afetados

Unknown · Allow svg files

Referências

https://wpscan.com/vulnerability/29015c35-0470-41b8-b197-c71b800ae2a9