CVE-2023-7089

Summary

CVE-2023-7089 is a vulnerability found in the Easy SVG Allow WordPress plugin version 1.0. It allows users with roles as low as Author to upload malicious SVG files containing XSS payloads, as the plugin fails to sanitize uploaded SVG files. This vulnerability has a base severity rating of MEDIUM, with a base score of 5.4 according to NIST's National Vulnerability Database (NVD). The exploitability score is 2.3 out of 10, indicating a relatively low level of difficulty for attackers to exploit this vulnerability. The impact score is 2.7, suggesting a moderate level of damage that can be caused by this vulnerability. The attack vector is through the network, and both the integrity and confidentiality impacts are assessed as low. The availability impact is none, meaning it does not affect the availability of the system. Remediation for this vulnerability involves updating the Easy SVG Allow plugin to a version that includes proper sanitization measures for uploaded SVG files.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.