What’s Vulnerable › Vulnerabilities

CVE-2024-4270: SVGMagic <= 1.1 - Stored XSS via SVG Upload

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-06-14 · updated 2026-06-17
• Weakness: CWE-79

Description

The SVGMagic WordPress plugin through 1.1 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.

Affected products

• SVGMagic: through 1.1

References

• https://wpscan.com/vulnerability/7a3b89cc-7a81-448a-94fc-36a7033609d5/
• https://wpscan.com/vulnerability/7a3b89cc-7a81-448a-94fc-36a7033609d5/

Get alerted when CVE-2024-4270 or the next vulnerability affects your stack