What’s Vulnerable › Vulnerabilities

CVE-2024-4271: SVGator <= 1.2.6 - Stored XSS via SVG Upload

• Severity: medium (CVSS 4.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-06-14 · updated 2026-06-17
• Weakness: CWE-79

Description

The SVGator WordPress plugin through 1.2.6 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.

Affected products

• SVGator – Add Animated SVG Easily: through 1.2.6

References

• https://wpscan.com/vulnerability/c1fe0bc7-a340-428e-a549-1e37291bea1c/
• https://wpscan.com/vulnerability/c1fe0bc7-a340-428e-a549-1e37291bea1c/

Get alerted when CVE-2024-4271 or the next vulnerability affects your stack