What’s Vulnerable › Vulnerabilities
CVE-2024-11847: WP SVG Upload <= 1.0.0 - Author+ Stored XSS via SVG
- Severity: medium (CVSS 4.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-03-26 · updated 2026-06-17
- Weakness: CWE-79
Description
The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.
Affected products
- wp-svg-upload: through 1.0.0
References
Get alerted when CVE-2024-11847 or the next vulnerability affects your stack