CVE-2024-9069

Summary

CVE-2024-9069 identifies a vulnerability in the Graphicsly plugin for WordPress, affecting all versions up to and including 1.0.2, which allows for Stored Cross-Site Scripting via SVG file uploads due to inadequate input sanitization and output escaping. This vulnerability enables authenticated attackers with Author-level access or higher to inject malicious web scripts into pages that execute when users access the SVG files. The potential danger to organizations includes unauthorized access to sensitive data and the ability to manipulate website content, posing a medium severity risk with an exploitability score of 3.1. To remediate this issue, it is recommended that users update the Graphicsly plugin to the latest version that addresses this vulnerability. Organizations should also consider implementing additional security measures such as input validation and monitoring for suspicious activity related to file uploads.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.