CVE-2024-5226

Name of the Vulnerable Software and Affected Versions Fuse Social Floating Sidebar plugin for WordPress versions up to, and including, 5.4.10

Description The issue is related to Stored Cross-Site Scripting via the file upload functionality due to insufficient validation of SVG files. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages, which will execute whenever a user accesses an injected page.

Recommendations For versions up to, and including, 5.4.10, update to a version that includes the fix for the Stored Cross-Site Scripting vulnerability. As a temporary workaround, consider restricting access to the file upload functionality to prevent exploitation. Additionally, restrict contributor-level access and above to minimize the risk of arbitrary web script injection.