CVE-2024-9060

Summary

CVE-2024-9060 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the AVIF & SVG Uploader plugin for WordPress in version 1.1.0. This issue arises due to inadequate input sanitization and output escaping during SVG file uploads. Authenticated attackers, including those with Author-level access or higher, can exploit this vulnerability by injecting malicious web scripts into uploaded SVG files. Consequently, whenever a user accesses the affected SVG file, the injected scripts will execute, potentially leading to unintended actions or data theft.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.