CVE-2023-2143: Enable SVG, WebP & ICO Upload <= 1.0.3 - Author+ Stored XSS

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-17 · updated 2026-06-17

Description

The Enable SVG, WebP & ICO Upload WordPress plugin through 1.0.3 does not sanitize SVG file contents, leading to a Cross-Site Scripting vulnerability.

Affected products

ideasToCode Enable SVG, WebP & ICO Upload (WordPress plugin): through 1.0.3

References

https://wpscan.com/vulnerability/91898762-aa7d-4fbc-a016-3de48901e5de
https://wpscan.com/vulnerability/91898762-aa7d-4fbc-a016-3de48901e5de

Get alerted when CVE-2023-2143 or the next vulnerability affects your stack