What’s Vulnerable › Vulnerabilities

CVE-2024-11184: WP Enabled SVG <= 0.7 - Author+ Stored XSS via SVG

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-01-02 · updated 2026-06-17

Description

The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts

Affected products

• wp-enable-svg: through 0.7

References

• https://wpscan.com/vulnerability/fc982bcb-9974-481f-aef4-580ae9edc3c8/
• https://wpscan.com/vulnerability/fc982bcb-9974-481f-aef4-580ae9edc3c8/

Get alerted when CVE-2024-11184 or the next vulnerability affects your stack