CVE-2024-11847

Summary

CVE-2024-11847 is a vulnerability affecting the wp-svg-upload WordPress plugin before version 1.0.0. This issue permits users with the author role or higher to inject malicious JavaScript code into SVG files due to insufficient sanitization of the file contents. Consequently, attackers can execute Stored Cross-Site Scripting (XSS) attacks on unsuspecting users, potentially leading to data theft, unauthorized access, or other undesirable outcomes. It is crucial for WordPress site administrators to update the plugin to a patched version promptly to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.