CVE-2024-9708

Name of the Vulnerable Software and Affected Versions Easy SVG Upload plugin for WordPress version 1.0 and earlier

Description The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticated attackers with Author-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

Recommendations For versions up to and including 1.0, update to a version that addresses the insufficient input sanitization and output escaping issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.